Sglang CVE-2026-86793

Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary

SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker

SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t

Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a

Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code b

Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe

Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the op

Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, wh

Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsy

Arbitrary file write in SGLang's multimodal generation runtime (version 5.10) allows a remote, unauthenticated attacker

High severity vulnerability in SGLang. SGLangs `replay_request_dump.py` contains an insecure pickle.load() without valid

SGLang versions up to and including v0.5.15 expose unauthenticated network endpoints that allow complete model weight ex