SG
Vendor
sgl-project
23
CVEs
0
On KEV
18
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112270 | SG sglang sgl-project | 6.5 | Oct 19 | SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx |
| CVE-2026-112269 | SG sglang sgl-project | 6.5 | Oct 19 | SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations |
| CVE-2026-112268 | SG sglang-router sgl-project | 6.3 | Oct 19 | sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes |
| CVE-2026-112267 | SG sglang sgl-project | 6.5 | Oct 19 | SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker |
| CVE-2026-112266 | SG sglang sgl-project | 5.9 | Oct 19 | SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching |
| CVE-2026-112083 | SG SGLang sgl-project | 5.3 | Oct 19 | sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service |
| CVE-2026-112082 | SG SGLang sgl-project | 7.5 | Oct 19 | sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service |
| CVE-2026-111392 | SG sglang sgl-project | 4.8 | Oct 16 | SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate |
| CVE-2026-111391 | SG sglang sgl-project | 8.1 | Oct 16 | SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter |
| CVE-2026-110809 | SG SGLang sgl-project | 4.3 | Oct 14 | sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service |
| CVE-2026-110807 | SG SGLang sgl-project | 4.3 | Oct 14 | sgl-project SGLang generate Endpoint io_struct.py denial of service |
| CVE-2026-109229 | SG sglang sgl-project | 7.5 | Oct 12 | SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor |
| CVE-2026-109228 | SG sglang sgl-project | 7.5 | Oct 12 | SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters |
| CVE-2026-109227 | SG sglang sgl-project | 7.5 | Oct 12 | SGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Video Preprocessing |
| CVE-2026-109226 | SG sglang sgl-project | 7.5 | Oct 12 | SGLang through 0.5.21 Audio Decompression Amplification via load_audio |
| CVE-2026-109225 | SG sglang sgl-project | 7.5 | Oct 12 | SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload |
| CVE-2026-105245 | SG sglang sgl-project | 3.7 | Oct 5 | sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission |
| CVE-2026-102634 | SG sglang sgl-project | 7.5 | Sep 29 | SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room |
| CVE-2026-93838 | SG sglang sgl-project | 5.9 | Sep 18 | SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx |
| CVE-2026-93688 | SG sglang sgl-project | 7.5 | Sep 18 | SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room |
| CVE-2026-92972 | SG sglang sgl-project | 8.6 | Sep 17 | SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint |
| CVE-2026-10775 | SG SGLang sgl-project | 5.3 | Jun 3 | sgl-project SGLang Cache data_hash denial of service |
| CVE-2026-7669 | SG SGLang sgl-project | 5.6 | May 2 | sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection |