SGLang vulnerabilities

SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp(). Unauthenticated network-adjacent attackers can exhaust Prefill memory by sending STAGING_RSP messages with huge chunk_idx values.

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates all other clients' requests.

SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash via /generate to disclose another request's image content or corrupt victims' responses.

SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure endpoint when DUMPER_SERVER_PORT is set, running code in the scheduler process on the next forward pass.

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstrap_room values to crash scheduler processes or hang other users' requests until transfer timeout.

SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when SGLANG_USE_PICKLE_IPC is disabled, and becomes remotely exploitable if data-parallel attention is enabled with a non-loopback --dist-init-addr setting.

SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the final frame of received multipart messages directly to pickle.loads() before any validation occurs.

SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr are resolvable, enabling code execution via pickle REDUCE.

SGLang contains a remote code execution (RCE) vulnerability when loading model weights from a HuggingFace repository. In the /update_weights_from_disk endpoint, torch.load with weights_only=False allows pickle deserialization of .bin files.

SGLang contains a remote code execution (RCE) vulnerability in the optional dumper subsystem. When DUMPER_SERVER_PORT is set, a sandbox escape is possible, enabling code execution on inference requests.

SGLang contains an unauthenticated remote code execution (RCE) vulnerability in the /load_lora_adapter_from_tensors endpoint. It bypasses SafeUnpickler's incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.

The vulnerability in SGLang involves an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface without authentication or deserialization safeguards. This allows an attacker to provide a malicious pickle file, resulting in unauthenticated remote code execution when the feature is enabled and the service is reachable over the network.

SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations with unique mooncake_session_id values and large nested-buffer frames to exhaust Prefill memory until the scheduler is OOM-killed.

SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstrap_host and bootstrap_port fields. Attackers sending crafted requests to the Decode worker's /generate endpoint can probe internal hosts and ports and block the shared scheduler loop, delaying other inference requests.

A security flaw in sgl-project SGLang up to 0.5.19 affects the WeightExporter.send_weights_to_remote_instance function in python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of the Weight Exporter component. Manipulation of the group_name argument results in denial of service, and the attack can be initiated remotely. The exploit has been released to the public, and the pull request to fix this issue awaits acceptance.

A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.create_req of the file python/sglang/srt/session/session_controller.py of the component Session Cleanup. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.

A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file python/sglang/srt/managers/io_struct.py of the component generate Endpoint. This manipulation of the argument session_params causes denial of service. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions, exhausting worker memory during decoding.

SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_tokens_per_frame and max_image_tokens in the video_url object. Attackers can set these values arbitrarily high so glm4v.py decodes every frame of high-resolution video at full size, exhausting worker memory and denying service.

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and concurrent requests exhaust worker memory causing denial of service.

SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio_url or audio_data inputs that expand into massive PCM buffers, exhausting worker memory and CPU for denial of service.

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before validation, to crash the HTTP/tokenizer worker and deny service.

A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the server_info function of the file python/sglang/srt/entrypoints/http_server.py of the HTTP Endpoint component. Manipulation of the api_key argument leads to cleartext transmission of sensitive information. The attack can be launched remotely, though it is highly complex and difficult to exploit. The exploit has been disclosed to the public and the pull request to fix this issue awaits acceptance.

SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial of service against the target server.

SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefill/decode disaggregation deployments. Attackers with access to the decode engine's internal ZMQ rank port can send a frame with an extremely large chunk_idx value, causing the scheduler to allocate memory until the system runs out and terminates the process.

SGLang through 0.5.19 in prefill/decode disaggregation mode with the Mooncake KV transfer backend fails to validate bootstrap_room values, allowing unbounded transfer state allocation. An unauthenticated attacker can reach the decode engine's POST /generate endpoint and submit arbitrary bootstrap_room values to exhaust prefill process memory until out-of-memory termination.

SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rank_ip and rank_port values to redirect decode workers to attacker-controlled endpoints, causing denial of service or disclosure of KV transfer metadata including session identifiers and tensor-parallel topology parameters.

SGLang contains a model weight exfiltration vulnerability when no API keys are configured. SGLang exposes two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then trigger data transfer, enabling exfiltration of all model weights.

SGLang contains a credential leakage vulnerability in the /server_info endpoint. When only the --admin-api-key is configured, this endpoint returns API keys and SSL keyfile information.

SGLang contains an SSRF and local file read vulnerability in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to internal metadata, secrets, and services.

Vulnerability in SGLang up to version 0.5.11 in the data_hash function of the Cache Handler component causes denial of service (DoS) via a local attack with high complexity. Exploit has been published.

In SGLang 0.5.10.post1, a reachable assertion vulnerability exists in the file python/sglang/srt/lora/lora_manager.py of the Inference HTTP Endpoint component via the lora_path argument. The attack is remote with high complexity, and an exploit has been disclosed.

In sgl-project SGLang up to 0.5.9, the get_tokenizer function in hf_transformers_utils.py of the HuggingFace Transformer Handler component, when trust_remote_code=False is passed, may silently re-invoke AutoTokenizer.from_pretrained with trust_remote_code=True if transformers v5 returns a TokenizersBackend. This can lead to arbitrary Python code execution from a malicious tokenizer.py in a model repository. The issue affects all SGLang versions due to transformers==5.3.0 being pinned.