CVE-2026-15971: Critical severity SGLang vulnerability
SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPERSERVERPORT is set, enabling code execution on inference requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or avoid enabling the optional dumper subsystem; do not set DUMPER_SERVER_PORT, since the RCE/sandbox escape occurs when the dumper subsystem is enabled with DUMPER_SERVER_PORT set.
SGLang dumper subsystem DUMPER_SERVER_PORT = unset/disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15971?
CVE-2026-15971 has a risk score of 77, indicating a high severity vulnerability.
How do I fix CVE-2026-15971?
To fix CVE-2026-15971, disable the dumper subsystem or ensure that DUMPER_SERVER_PORT is not set.
What software is affected by CVE-2026-15971?
CVE-2026-15971 affects the SGLang software.
What type of vulnerability is CVE-2026-15971?
CVE-2026-15971 is a remote code execution (RCE) vulnerability.
What can happen if CVE-2026-15971 is exploited?
Exploitation of CVE-2026-15971 allows for a sandbox escape and unauthorized code execution on inference requests.