EUVD-2026-83282
GHSA-2wcg-j54r-m6wm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, unauthenticated ZMQ port (AV:N/PR:N), but exploitation requires a non-default disaggregation deployment and access to an internal rank port (AC:H mirrors 4.0 AT:P); availability-only DoS.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefill/decode disaggregation deployments. Attackers with access to the decode engine's internal ZMQ rank port can send a frame with an extremely large chunk_idx value, causing the scheduler to allocate memory until the system runs out and terminates the process.
AnalysisAI
Memory-exhaustion denial of service in SGLang through 0.5.20 allows anyone who can reach the decode engine's internal ZMQ rank port to terminate the serving process by sending a single STAGING_REQ frame carrying an extremely large chunk_idx value. The flaw applies only to deployments running prefill/decode disaggregation - a non-default, multi-engine serving topology - and requires network reachability to the inter-rank ZMQ port that normally carries unauthenticated traffic on a trusted cluster network; when that port is bound to loopback or an isolated back-end network, the issue is not reachably exploitable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) SGLang deployed in prefill/decode disaggregation mode (a non-default, multi-engine serving topology), and (2) network reachability to the decode engine's internal ZMQ rank port, which normally carries unauthenticated inter-rank traffic on a trusted cluster network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but scope-limited availability threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis, and no exact fixed version is confirmed in the available data, so operators should treat network isolation as the primary control: bind the decode engine's internal ZMQ rank port to loopback or a dedicated back-end interface and enforce firewall or security-group rules that permit only known prefill/rank peers to reach it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SGLang instances and confirm which are actually running prefill/decode disaggregation, since the flaw does not affect default single-engine deployments, and immediately verify how the inter-rank ZMQ port is bound - it should be bound to loopback or an isolated back-end network rather than a routable address. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code b
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe
Remote code execution in SGLang AI inference servers allows unauthenticated attackers to run arbitrary code through the
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the op
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, wh
Unauthenticated remote code execution in SGLang versions through v0.5.20 arises from unsafe pickle deserialization in th
Unauthenticated remote code execution in SGLang 0.5.11 through 0.5.14 occurs when the multimodal generation runtime is l
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsy
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today