EUVD-2026-34185
GHSA-jrcc-j37m-v8fg
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in sgl-project SGLang up to 0.5.11. Affected by this vulnerability is the function data_hash of the component Cache Handler. This manipulation causes denial of service. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
AnalysisAI
Hash collision weaknesses in SGLang's multimodal Cache Handler (all versions through 0.5.11) allow a local low-privilege attacker to craft multimodal tensor inputs that produce identical cache keys via truncated SHA256 digests, causing incorrect cache lookups or cache invalidation failures that disrupt LLM serving workflows. The CVSS 4.0 score of 1.1 reflects the strictly local attack vector and high exploitation complexity, limiting real-world impact primarily to multi-tenant inference deployments. Publicly available exploit code exists per GitHub issue #25462, though no confirmed active exploitation has been observed and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
SGLang is an open-source Python framework for high-throughput LLM inference serving, including multimodal inputs such as images and tensors. The vulnerability resides in python/sglang/srt/managers/mm_utils.py and python/sglang/srt/mem_cache/multimodal_cache.py. The data_hash and tensor_hash functions truncated SHA256 digests to only 8 bytes (64 bits), providing insufficient collision resistance for a cache key namespace serving diverse multimodal inputs. Critically, tensor hashes omitted shape and dtype boundary metadata, meaning different tensor partitions with identical raw byte values produced identical hashes. The multimodal_cache.py combiner used Python's built-in non-deterministic hash() instead of a stable cryptographic primitive, causing inconsistent cache behavior across process restarts. Nested list inputs lacked type-tagged serialization, enabling cross-type and cross-structure collisions. CWE-404 (Improper Resource Shutdown or Release) is the assigned root cause class; the PR diff evidence suggests the more proximate cause is insufficient hash entropy and missing structural metadata in cache key derivation, though the DoS manifestation is consistent with cache resources being misallocated or incorrectly released due to colliding keys. The CPE cpe:2.3:a:sgl-project:sglang:*:*:*:*:*:*:*:* covers all SGLang releases up to and including 0.5.11.
RemediationAI
Upstream fix available via GitHub PR #22033 (https://github.com/sgl-project/sglang/pull/22033), which expands SHA256 truncation from 8 to 16 bytes across all hash functions, introduces shape and dtype boundary markers as structural metadata in tensor hash derivation, replaces Python's non-deterministic hash() in multimodal_cache.py with deterministic SHA256, and adds type-tagged serialization for nested list inputs to prevent cross-type collisions. However, this PR was awaiting acceptance at the time of disclosure - a released patched version is not independently confirmed. Monitor the upstream repository at https://github.com/sgl-project/sglang/ and the VulDB advisory at https://vuldb.com/vuln/368138 for a tagged release incorporating these changes. As a compensating control, restrict local user access to shared SGLang serving processes in multi-tenant environments, as the attack requires local low-privilege access; this does not eliminate the vulnerability but removes the attacker's access prerequisite. Validating that multimodal feature inputs are at least 2D tensors before entering the cache pipeline (as added in base_processor.py in the fix) can be applied as a partial input-sanitization measure. No workaround fully substitutes for the hash entropy and metadata fixes in PR #22033.
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code b
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the op
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, wh
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsy
Arbitrary file write in SGLang's multimodal generation runtime (version 5.10) allows a remote, unauthenticated attacker
High severity vulnerability in SGLang. SGLangs `replay_request_dump.py` contains an insecure pickle.load() without valid
SGLang versions up to and including v0.5.15 expose unauthenticated network endpoints that allow complete model weight ex
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today