Sgl-project Sglang vulnerabilities

• sgl-project sglang SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx CVE-2026-112270 7.1 HighOctober 19, 2026
• sgl-project sglang SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations CVE-2026-112269 7.1 HighOctober 19, 2026
• sgl-project sglang-router sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes CVE-2026-112268 5.3 MediumOctober 19, 2026
• sgl-project sglang SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker CVE-2026-112267 6.9 MediumOctober 19, 2026
• sgl-project sglang SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching CVE-2026-112266 8.2 HighOctober 19, 2026
• sgl-project sglang sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service CVE-2026-112083 6.9 MediumOctober 19, 2026
• sgl-project sglang sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service CVE-2026-112082 8.7 HighOctober 19, 2026
• sgl-project sglang SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate CVE-2026-111392 6.3 MediumOctober 16, 2026
• sgl-project sglang SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter CVE-2026-111391 9.2 CriticalOctober 16, 2026
• sgl-project sglang sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service CVE-2026-110809 5.3 MediumOctober 14, 2026
• sgl-project sglang sgl-project SGLang generate Endpoint io_struct.py denial of service CVE-2026-110807 5.3 MediumOctober 14, 2026
• sgl-project sglang SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor CVE-2026-109229 8.7 HighOctober 12, 2026
• sgl-project sglang SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters CVE-2026-109228 8.7 HighOctober 12, 2026
• sgl-project sglang SGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Video Preprocessing CVE-2026-109227 8.7 HighOctober 12, 2026
• sgl-project sglang SGLang through 0.5.21 Audio Decompression Amplification via load_audio CVE-2026-109226 8.7 HighOctober 12, 2026
• sgl-project sglang SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload CVE-2026-109225 8.7 HighOctober 12, 2026
• sgl-project sglang CVE-2026-93034 CVE-2026-93034 9.8 CriticalOctober 8, 2026
• sgl-project sglang sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission CVE-2026-105245 Fix available 6.3 MediumOctober 5, 2026
• sgl-project sglang SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room CVE-2026-102634 Fix available 8.7 HighSeptember 29, 2026
• sgl-project sglang CVE-2026-94570 CVE-2026-94570 5.9 MediumSeptember 22, 2026
• sgl-project sglang CVE-2026-93088 CVE-2026-93088 9.8 CriticalSeptember 22, 2026
• sgl-project sglang SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx CVE-2026-93838 8.2 HighSeptember 18, 2026
• sgl-project sglang SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room CVE-2026-93688 8.7 HighSeptember 18, 2026
• sgl-project sglang SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint CVE-2026-92972 8.8 HighSeptember 17, 2026
• sgl-project sglang CVE-2026-86793 CVE-2026-86793 9.8 CriticalSeptember 11, 2026
• lmsys sglang CVE-2026-15969 CVE-2026-15969 9.8 CriticalJuly 30, 2026
• lmsys sglang CVE-2026-15978 CVE-2026-15978 7.5 HighJuly 30, 2026
• lmsys sglang CVE-2026-15977 CVE-2026-15977 7.5 HighJuly 30, 2026
• lmsys sglang CVE-2026-15976 CVE-2026-15976 9.8 CriticalJuly 30, 2026
• lmsys sglang CVE-2026-15974 CVE-2026-15974 6.5 MediumJuly 30, 2026
• lmsys sglang CVE-2026-15971 CVE-2026-15971 9.8 CriticalJuly 30, 2026
• lmsys sglang CVE-2026-14890 CVE-2026-14890 9.1 CriticalJuly 16, 2026
• lmsys sglang sgl-project SGLang Cache data_hash denial of service CVE-2026-10775 2.0 LowJune 3, 2026
• sgl-project sglang SGLang Inference HTTP Endpoint lora_manager.py assertion CVE-2026-10300 6.3 MediumJune 1, 2026
• lmsys sglang CVE-2026-7304 CVE-2026-7304 9.8 CriticalMay 18, 2026
• lmsys sglang CVE-2026-7302 CVE-2026-7302 9.1 CriticalMay 18, 2026
• lmsys sglang CVE-2026-7301 CVE-2026-7301 9.8 CriticalMay 18, 2026
• sgl-project sglang sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection CVE-2026-7669 Public exploit 6.3 MediumMay 2, 2026
• lmsys sglang CVE-2026-5760 CVE-2026-5760 Public exploit 9.8 CriticalApril 20, 2026
• lmsys sglang CVE-2026-3989 CVE-2026-3989 Fix available 7.8 HighMarch 12, 2026
• lmsys sglang CVE-2026-3060 CVE-2026-3060 Fix available 9.8 CriticalMarch 12, 2026
• lmsys sglang CVE-2026-3059 CVE-2026-3059 Fix available 9.8 CriticalMarch 12, 2026
• lmsys sglang lmsys sglang update_weights_from_tensor main deserialization CVE-2025-10164 Fix available 6.9 MediumSeptember 9, 2025