Advisories · Technology
sgl-project sglang.
Every CVE that names sgl-project sglang among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx
- sgl-project sglang
- Denial of service
- CVSS 7.1 High
SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations
- sgl-project sglang
- Denial of service
- CVSS 6.9 Medium
SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker
- sgl-project sglang
- Server-side request forgery (SSRF)
- CVSS 8.2 High
SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching
- sgl-project sglang
- CWE-187
- CVSS 6.9 Medium
sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service
- sgl-project SGLang
- Denial of service
- CVSS 8.7 High
sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service
- sgl-project SGLang
- Denial of service
- CVSS 6.3 Medium
SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate
- sgl-project sglang
- CWE-345
- CVSS 9.2 CriticalCritical · CVSS 9+
SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter
- sgl-project sglang
- Code injection
- CVSS 5.3 Medium
sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service
- sgl-project SGLang
- Denial of service
- CVSS 5.3 Medium
sgl-project SGLang generate Endpoint io_struct.py denial of service
- sgl-project SGLang
- Denial of service
- CVSS 8.7 High
SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor
- sgl-project sglang
- CWE-409
- CVSS 8.7 High
SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters
- sgl-project sglang
- Denial of service
- CVSS 8.7 High
SGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Video Preprocessing
- sgl-project sglang
- Denial of service
- CVSS 8.7 High
SGLang through 0.5.21 Audio Decompression Amplification via load_audio
- sgl-project sglang
- CWE-409
- CVSS 8.7 High
SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload
- sgl-project sglang
- Denial of service
- CVSS 6.3 Medium
sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission
- sgl-project sglang
- Weak cryptography or TLS
- CWE-310
- CVSS 8.7 High
SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room
- sgl-project sglang
- CWE-694
- CVSS 8.2 High
SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx
- sgl-project sglang
- Denial of service
- CVSS 8.7 High
SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room
- sgl-project sglang
- Denial of service
- CVSS 8.8 High
SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint
- sgl-project sglang
- Authentication bypass