EUVD-2026-94989
GHSA-w4hv-c72g-pqx6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated deserialization gives PR:N and full C/I/A:H once the endpoint is reachable; AC:L reflects trivial attacker action, though network reach depends on a non-default non-loopback dist-init-addr.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
4DescriptionCVE.org
SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when SGLANG_USE_PICKLE_IPC is disabled, and becomes remotely exploitable if data-parallel attention is enabled with a non-loopback --dist-init-addr setting.
AnalysisAI
Unauthenticated remote code execution in SGLang versions through v0.5.20 arises from unsafe pickle deserialization in the ZMQ message decoder, which processes PickleWrapper payloads via pickle.loads() without type allowlisting or authentication. While default single-node deployments bind the ZMQ control channel to loopback, remote exploitation becomes possible when data-parallel attention is enabled and --dist-init-addr is set to a non-loopback address. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Default/local exposure: the pickle deserialization occurs on the ZMQ control channel which is normally loopback-bound, so default single-node deployments are exploitable primarily by a local attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes an unauthenticated, network-reachable RCE via unsafe pickle deserialization (CWE-502) - on paper a maximum-urgency flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SGLang deployments and confirm versions through v0.5.20; for any instance with data-parallel attention enabled and --dist-init-addr set to a non-loopback address, immediately restrict the ZMQ control channel to loopback, disable data-parallel attention if not essential, and block external network access to the affected service ports. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code b
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe
Remote code execution in SGLang AI inference servers allows unauthenticated attackers to run arbitrary code through the
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the op
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, wh
Unauthenticated remote code execution in SGLang 0.5.11 through 0.5.14 occurs when the multimodal generation runtime is l
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsy
Arbitrary file write in SGLang's multimodal generation runtime (version 5.10) allows a remote, unauthenticated attacker
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today