CVE-2026-15971

CriticalCVSS 9.8

Published: 30/07/2026(UTC)Updated: 31/07/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

33th percentile - higher than 33% of all known CVEs

Summary

SGLang contains a remote code execution (RCE) vulnerability in the optional dumper subsystem. When DUMPER_SERVER_PORT is set, a sandbox escape is possible, enabling code execution on inference requests.

Risk Assessment

An attacker can gain full control over the server by executing arbitrary code in the context of the SGLang process, potentially compromising data confidentiality and integrity.

Recommendation

Disable the dumper subsystem if not required, or set strong access restrictions on the DUMPER_SERVER_PORT.

Original NVD description (English source)

SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests.