SGLang vulnerabilities
We track 16 vulnerabilities in SGLang products. 16 are rated high or critical, and none are known to be exploited. The most recent was published on October 8, 2026.
Latest SGLang vulnerabilities
- 9.8 Critical severity
SGLang: Deserialization of Untrusted Data
SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this vulnerability persists
- 9.8 Critical severity
SGLang: Deserialization of Untrusted Data
SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the final frame
- 9.8 Critical severity
SGLang: Improper Control of Generation of Code
SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr are resolvable, enabling code execution via pic
- 7.5 High severity
SGLang: Missing Authentication for Critical Functionality
SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can e
- 7.5 High severity
SGLang: Insufficiently Protected Credentials
SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured.
- 9.8 Critical severity
SGLang: Deserialization of Untrusted Data
SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.load(..., weights_only=False) fallback enables pickle deserialization of .bin files.
- 9.8 Critical severity
SGLang: Improper Neutralization of Directives in Dynamically Evaluated Code
SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests.
- 9.8 Critical severity
SGLang: Deserialization of Untrusted Data
SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.
- 9.1 Critical severity
SGLang: Deserialization of Untrusted Data
SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deserialization safeguards, allowing an attacker to provide a malicious pickle file that results in unauth
- 9.8 Critical severity
SGLang: Deserialization of Untrusted Data
SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option is enabled, as Python objects loaded via dill.loads() will be deserialized without validation.
- 9.1 Critical severity
SGLang: Path Traversal: '.../...//'
SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to s
- 9.8 Critical severity
SGLang: Deserialization of Untrusted Data
SGLangs multimodal generation runtime scheduler's ROUTER socket binds to 0.0.0.0 by default and contains a sink that calls pickle.loads() on incoming messages, enabling RCE when exposed to the internet.
- 9.8 Critical severity
SGLang: Improper Control of Generation of Code
SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_template is loaded, as the Jinja2 chat templates are rendered using an unsandboxed jinja2.Environment().
- 7.8 High severity
SGLang: Deserialization of Untrusted Data
SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by providing a malicious .pkl file, which will execute the attackers code on the device running the script
- 9.8 Critical severity
SGLang: Deserialization of Untrusted Data
SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication.
- 9.8 Critical severity
SGLang: Deserialization of Untrusted Data
SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication.