Latest high and critical flaws
- CVE-2026-112270 SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthHigh 7.1 · Oct 19, 2026
- CVE-2026-112269 SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowinHigh 7.1 · Oct 19, 2026
- CVE-2026-112266 SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a shorHigh 8.2 · Oct 19, 2026
- CVE-2026-112082 A vulnerability was identified in sgl-project SGLang up to 0.5.19.High 7.7 · Oct 19, 2026
- CVE-2026-111391 SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eCritical 9.2 · Oct 16, 2026
- CVE-2026-109229 SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXEHigh 8.7 · Oct 12, 2026
- CVE-2026-109228 SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, mHigh 8.7 · Oct 12, 2026
- CVE-2026-109227 SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution befoHigh 8.7 · Oct 12, 2026
- CVE-2026-109226 SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly comHigh 8.7 · Oct 12, 2026
- CVE-2026-109225 SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversizeHigh 8.7 · Oct 12, 2026
- CVE-2026-102634 SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer baHigh 8.7 · Sep 29, 2026
- CVE-2026-93838 SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REHigh 8.2 · Sep 18, 2026
- CVE-2026-93688 SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allowing unbounded transfHigh 8.7 · Sep 18, 2026
- CVE-2026-92972 SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackeHigh 8.8 · Sep 17, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.