SG
Product
sglang
22
CVEs
0
On KEV
8.6
Max CVSS
17
New 30D
Severity mix
Critical 0High 10Medium 11Low 1
Watch
Add sglang to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-92972 | 8.6 | Sep 17 | SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint Affected: through 0.5.19 |
| CVE-2026-111391 | 8.1 | Oct 16 | SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter Affected: 0.5.10 through 0.5.22 |
| CVE-2026-112082 | 7.5 | Oct 19 | sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service Affected: 0.5.0; 0.5.1; 0.5.2; 0.5.3; 0.5.4; 0.5.5; +14 more |
| CVE-2026-109229 | 7.5 | Oct 12 | SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor Affected: through 0.5.21 |
| CVE-2026-109228 | 7.5 | Oct 12 | SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters Affected: through 0.5.21 |
| CVE-2026-109227 | 7.5 | Oct 12 | SGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Video Preprocessing Affected: through 0.5.21 |
| CVE-2026-109226 | 7.5 | Oct 12 | SGLang through 0.5.21 Audio Decompression Amplification via load_audio Affected: through 0.5.21 |
| CVE-2026-109225 | 7.5 | Oct 12 | SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload Affected: through 0.5.21 |
| CVE-2026-102634 | 7.5 | Sep 29 | SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room Affected: through 0.5.20 |
| CVE-2026-93688 | 7.5 | Sep 18 | SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room Affected: through 0.5.19 |
Showing 10