9.8

CVE-2026-3059

Medienbericht
Exploit

CVE-2026-3059

SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lmsys ≫ Sglang Version >= 0.5.5 <= 0.5.9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.53% 0.716
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
17.03.2026 22:19
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
17.03.2026 22:19
https://github.com/sgl-project/sglang/security/advisories/GHSA-3cp7-c6q2-94xr
Broken Link
https://github.com/sgl-project/sglang/blob/main/python/sglang/multimodal_gen/runtime/scheduler_client.py
Product
https://orca.security/resources/blog/sglang-llm-framework-rce-vulnerabilities/
Third Party Advisory
Exploit
Mitigation
https://github.com/sgl-project/sglang/pull/20904
https://github.com/sgl-project/sglang/releases/tag/v0.5.10