SGLang vulnerabilities
CVEs whose affected-version data names the SGLang package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
32 CVEsRSS
CVE-2026-3989High· 7.8SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization
SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization
▾ Twilightsglang · sglangEPSS 0.47%via OSV
CVE-2025-10164High· 7.3SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor
SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor
▾ Twilightsglang · sglangEPSS 0.41%via OSV