SG
Product
sglang
22
CVEs
0
On KEV
8.6
Max CVSS
17
New 30D
Severity mix
Critical 0High 10Medium 11Low 1
Watch
Add sglang to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-112270 | 6.5 | Oct 19 | SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx Affected: through 0.5.22 |
| CVE-2026-112269 | 6.5 | Oct 19 | SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations Affected: through 0.5.22 |
| CVE-2026-112267 | 6.5 | Oct 19 | SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker Affected: through 0.5.22 |
| CVE-2026-112266 | 5.9 | Oct 19 | SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching Affected: through 0.5.22 |
| CVE-2026-93838 | 5.9 | Sep 18 | SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx Affected: through 0.5.20 |
| CVE-2026-7669 | 5.6 | May 2 | sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection Affected: 0.5.0; 0.5.1; 0.5.2; 0.5.3; 0.5.4; 0.5.5; +4 more |
| CVE-2026-112083 | 5.3 | Oct 19 | sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service Affected: 0.5.0; 0.5.1; 0.5.2; 0.5.3; 0.5.4; 0.5.5; +14 more |
| CVE-2026-10775 | 5.3 | Jun 3 | sgl-project SGLang Cache data_hash denial of service Affected: 0.5.0; 0.5.1; 0.5.2; 0.5.3; 0.5.4; 0.5.5; +6 more |
| CVE-2026-111392 | 4.8 | Oct 16 | SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate Affected: 0.5.13 through 0.5.21 |
| CVE-2026-110809 | 4.3 | Oct 14 | sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service Affected: 0.5.0; 0.5.1; 0.5.2; 0.5.3; 0.5.4; 0.5.5; +14 more |
| CVE-2026-110807 | 4.3 | Oct 14 | sgl-project SGLang generate Endpoint io_struct.py denial of service Affected: 0.5.0; 0.5.1; 0.5.2; 0.5.3; 0.5.4; 0.5.5; +14 more |
Showing 11