sgl-project SGLang

• CVE-2026-112270 Medium 6.5 SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx 0.2%
• CVE-2026-112269 Medium 6.5 SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations 0.5%
• CVE-2026-112267 Medium 6.5 SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker 0.4%
• CVE-2026-112266 Medium 5.9 SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching 0.4%
• CVE-2026-112083 Medium 5.3 sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service 0.4%
• CVE-2026-112082 High 7.5 sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service 0.6%
• CVE-2026-111392 Medium 4.8 SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate 0.2%
• CVE-2026-111391 High 8.1 SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter 0.5%
• CVE-2026-110809 Medium 4.3 sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service 0.3%
• CVE-2026-110807 Medium 4.3 sgl-project SGLang generate Endpoint io_struct.py denial of service 0.3%
• CVE-2026-109229 High 7.5 SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor 0.5%
• CVE-2026-109228 High 7.5 SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters 0.5%
• CVE-2026-109227 High 7.5 SGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Video Preprocessing 0.5%
• CVE-2026-109226 High 7.5 SGLang through 0.5.21 Audio Decompression Amplification via load_audio 0.6%
• CVE-2026-109225 High 7.5 SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload 0.4%
• CVE-2026-105245 Low 3.7 sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission 0.2%
• CVE-2026-102634 High 7.5 SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room 0.6%
• CVE-2026-93838 Medium 5.9 SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx 0.7%
• CVE-2026-93688 High 7.5 SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room 0.7%
• CVE-2026-92972 High 8.6 SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint 0.5%
• CVE-2026-10775 Low 3.6 sgl-project SGLang Cache data_hash denial of service 0.1%
• CVE-2026-7669 Medium 5.6 sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection 0.4%