EUVD-2026-33833
GHSA-m2jr-x4gq-5rmj
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in SGLang 0.5.10.post1. Impacted is an unknown function of the file python/sglang/srt/lora/lora_manager.py of the component Inference HTTP Endpoint. Such manipulation of the argument lora_path leads to reachable assertion. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.
AnalysisAI
Reachable assertion in SGLang 0.5.10.post1's LoRA adapter scheduler allows a remote unauthenticated attacker to trigger a denial of service via a crafted lora_path argument to the inference HTTP endpoint. The root cause is a logic flaw in the batch prefill scheduler: chunked LoRA prefill requests already admitted to the prefill queue are invisible to the LoRA admission check, enabling N+1 distinct adapters to be submitted when max_loras_per_batch=N, which forces an assertion failure in lora_manager.py. A publicly available proof-of-concept exists (no public exploit identified at time of analysis in the KEV sense), and the CVSS 4.0 score of 2.9 reflects high attack complexity and limited availability impact.
Technical ContextAI
CWE-617 (Reachable Assertion) arises when attacker-controlled input drives program execution into a code path where an assert statement evaluates to false, crashing the process or thread. In SGLang, the flaw lives in python/sglang/srt/managers/scheduler.py: the _get_new_batch_prefill_raw method computes the set of active LoRA adapters (running_loras) exclusively from self.running_batch.reqs, ignoring requests already placed into the prefill adder's can_run_list - particularly the chunked_req, which is admitted unconditionally before the waiting queue is processed. This means one LoRA slot is silently consumed without the admission gate knowing, allowing the scheduler to admit a (max_loras_per_batch+1)-th distinct adapter. When lora_manager.py later validates the batch, the assertion on adapter count fails. SGLang is a Python-based LLM serving framework supporting LoRA (Low-Rank Adaptation) hot-swapping at inference time. Affected CPE: cpe:2.3:a:n/a:sglang:*:*:*:*:*:*:*:* at version 0.5.10.post1.
RemediationAI
An upstream fix is available as GitHub pull request #25078 (https://github.com/sgl-project/sglang/pull/25078), which introduces the _collect_committed_lora_ids method to correctly union LoRA IDs from both running_batch.reqs and the prefill adder's can_run_list before enforcing max_loras_per_batch. However, the CVE description explicitly states this PR 'awaits acceptance,' and a released patched version is not independently confirmed - organizations should monitor the SGLang repository for a tagged release incorporating this fix and apply it promptly. As a compensating control, disabling LoRA support entirely (do not pass --enable-lora or equivalent configuration) eliminates the vulnerable code path at the cost of losing LoRA adapter functionality. If LoRA is operationally required, restricting network access to the inference HTTP endpoint to trusted internal clients only reduces exposure, though it does not eliminate the vulnerability for insider-threat scenarios.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today