CVE-2025-10164

lmsys sglang update_weights_from_tensor main deserialization

6.9 MediumFix available

A security flaw has been discovered in lmsys sglang 0.4.6. Affected by this vulnerability is the function main of the file /update_weights_from_tensor. The manipulation of the argument serialized_named_tensors results in deserialization. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.41%Up 0.4 points since Sep 10, 2025

What each source reports

CVE List Score used 6.9

lmsys sglang update_weights_from_tensor main deserialization

Record: CVE-2025-10164
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CVSS 3.0: 7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CVSS 2.0: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
Weakness: CWE-502, CWE-20
Updated: 2026-11-02

EUVDEUVD-2025-27461 6.9

Record: EUVD-2025-27461
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Updated: 2026-11-02

GitHub AdvisoriesGHSA-9w53-xr52-mwgj 5.5

SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor

Record: GHSA-9w53-xr52-mwgj
CVSS 4.0: 5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-20, CWE-502
Updated: 2026-11-02

NVD 5.5

Record: CVE-2025-10164
CVSS 4.0: 5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-20, CWE-502
Updated: 2026-11-02

OSVGHSA-9w53-xr52-mwgj 5.5

SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor

Record: GHSA-9w53-xr52-mwgj
CVSS 4.0: 5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-20, CWE-502
Updated: 2026-11-02

OSVPYSEC-2026-1919 5.5

SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor

Record: PYSEC-2026-1919
CVSS 4.0: 5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`sglang` PyPI	through 0.5.3	0.5.4
`sglang` PyPI	before 0.5.4, plus listed versions 0.1.100.1.110.1.120.1.130.1.14 Show 45 moreShow less 0.1.150.1.160.1.170.1.180.1.190.1.200.1.210.1.220.1.240.1.250.1.260.1.30.1.40.1.50.1.60.1.70.1.90.2.00.2.10.2.100.2.110.2.120.2.130.2.140.2.14.post10.2.14.post20.2.150.2.20.2.30.2.40.2.50.2.60.2.70.2.80.2.90.2.9.post10.3.00.3.10.3.1.post10.3.1.post20.3.1.post30.3.20.3.30.3.3.post10.3.4	0.5.4

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-10164 is a medium vulnerability (CVSS 6.9) in Lmsys Sglang, published September 9, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in sglang 0.5.4.

References

This page doesn't list everything

Left out here: 76 versions. The JSON record has them.