CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2026-3060
Critical (9.8) in lmsys sglang. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in sglang 0.5.10.
SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- lmsys:sglang
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jx93-g359-86wm | PyPI | sglang | <0.5.10 | 0.5.10 |
| PYSEC-2026-537 | PyPI | sglang | <0.5.10 | 0.5.10 |