CVE-2026-3059: Critical severity Lmsys Sglang vulnerability
SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3059?
CVE-2026-3059 has a high severity rating due to the potential for unauthenticated remote code execution.
How do I fix CVE-2026-3059?
To fix CVE-2026-3059, update the SGLang package to a version higher than 0.5.9 that addresses this vulnerability.
What types of systems are affected by CVE-2026-3059?
CVE-2026-3059 affects systems using SGLang versions up to and including 0.5.9 that utilize the multimodal generation module with ZMQ.
What are the potential impacts of CVE-2026-3059?
The potential impacts of CVE-2026-3059 include unauthorized access and execution of malicious code on affected systems.
Is authentication required to exploit CVE-2026-3059?
No, CVE-2026-3059 can be exploited without any form of authentication, making it particularly concerning.