[ Vendor · 18 CVEs ]
sgl-project
CVEs affecting sgl-project published in the last 30 days, plus any sgl-project CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-112267 | 19 Oct 2026 | CVSS 6.5 | sgl-project sglangSGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated… | |
| CVE-2026-112268 | 19 Oct 2026 | CVSS 6.3 | sgl-project sglang-routersglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to… | |
| CVE-2026-112269 | 19 Oct 2026 | CVSS 6.5 | sgl-project sglangSGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL… | |
| CVE-2026-112270 | 19 Oct 2026 | CVSS 6.5 | sgl-project sglangSGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that… | |
| CVE-2026-112266 | 19 Oct 2026 | CVSS 5.9 | sgl-project sglangSGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by… | |
| CVE-2026-112082 | 19 Oct 2026 | CVSS 7.5 | sgl-project SGLangA vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file… | |
| CVE-2026-112083 | 19 Oct 2026 | CVSS 5.3 | sgl-project SGLangA security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send_weights_to_remote_instance of… | |
| CVE-2026-111392 | 16 Oct 2026 | CVSS 4.8 | sgl-project sglangSGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV… | |
| CVE-2026-111391 | 16 Oct 2026 | CVSS 8.1 | sgl-project sglangSGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by… | |
| CVE-2026-110809 | 15 Oct 2026 | CVSS 4.3 | sgl-project SGLangA security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.create_req of the file… | |
| CVE-2026-110807 | 14 Oct 2026 | CVSS 4.3 | sgl-project SGLangA weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file… | |
| CVE-2026-109228 | 12 Oct 2026 | CVSS 7.5 | sgl-project sglangSGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by… | |
| CVE-2026-109229 | 12 Oct 2026 | CVSS 7.5 | sgl-project sglangSGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting… | |
| CVE-2026-109225 | 12 Oct 2026 | CVSS 7.5 | sgl-project sglangSGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by… | |
| CVE-2026-109226 | 12 Oct 2026 | CVSS 7.5 | sgl-project sglangSGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting… | |
| CVE-2026-109227 | 12 Oct 2026 | CVSS 7.5 | sgl-project sglangSGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source… | |
| CVE-2026-105245 | 5 Oct 2026 | CVSS 3.7 | sgl-project sglangA vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function server_info of the file… | |
| CVE-2026-102634 | 29 Sep 2026 | CVSS 7.5 | sgl-project sglangSGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV… |