Vulnerability · Published Sep 22, 2026 · Assigned by certcc
CVE-2026-94570CVE-2026-94570
Medium 5.9
In plain English
A medium-severity security flaw in SGLang from SGLang. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.5%top 59.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial of service against the target server.
Affected products (as reported)
Weakness: CWE-1287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H