IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-03-12 12:15

MODIFIED

2026-03-12 12:15

EPSS (Prob. Exploit)

1.50%

Top 25.9%

DATA SOURCES:

NVD 🔗 2026-03-12 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-05 OSV 🔗 2026-07-26

> DESCRIPTION

SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-jx93-g359-86wm CRITICAL

SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module

AFFECTED PACKAGES:

PIP / sglang

<= 0.5.9

Fixed in: 0.5.10

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

CVE-2026-3060

AFFECTED PACKAGES:

Unknown / Unknown

12 versions affected

ALIASES:

GHSA-jx93-g359-86wm, PYSEC-2026-537

> HISTORIQUE DES MODIFICATIONS

Première apparition

12/03/2026 12:15

Source: NVD

Total des modifications: 0 Dernière mise à jour: 7 months ago

> REFERENCES

https://github.com/sgl-project/sglang/blob/main/python/sglang/srt/disaggregation...

https://orca.security/resources/blog/sglang-llm-framework-rce-vulnerabilities/