CVE-2026-102634

SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when SGLANG_USE_PICKLE_IPC is disabled, and becomes remotely exploitable if data-parallel attention is enabled with a non-loopback --dist-init-addr setting.

SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the final frame of received multipart messages directly to pickle.loads() before any validation occurs.

SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr are resolvable, enabling code execution via pickle REDUCE.

SGLang contains a remote code execution (RCE) vulnerability when loading model weights from a HuggingFace repository. In the /update_weights_from_disk endpoint, torch.load with weights_only=False allows pickle deserialization of .bin files.

SGLang contains a remote code execution (RCE) vulnerability in the optional dumper subsystem. When DUMPER_SERVER_PORT is set, a sandbox escape is possible, enabling code execution on inference requests.

SGLang contains an unauthenticated remote code execution (RCE) vulnerability in the /load_lora_adapter_from_tensors endpoint. It bypasses SafeUnpickler's incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.

The vulnerability in SGLang involves an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface without authentication or deserialization safeguards. This allows an attacker to provide a malicious pickle file, resulting in unauthenticated remote code execution when the feature is enabled and the service is reachable over the network.

A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the server_info function of the file python/sglang/srt/entrypoints/http_server.py of the HTTP Endpoint component. Manipulation of the api_key argument leads to cleartext transmission of sensitive information. The attack can be launched remotely, though it is highly complex and difficult to exploit. The exploit has been disclosed to the public and the pull request to fix this issue awaits acceptance.

SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial of service against the target server.

SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefill/decode disaggregation deployments. Attackers with access to the decode engine's internal ZMQ rank port can send a frame with an extremely large chunk_idx value, causing the scheduler to allocate memory until the system runs out and terminates the process.