CVE-2026-7304: Critical severity SGLangs SGLangs multimodal generation runtime vulnerability
SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option is enabled, as Python objects loaded via dill.loads() will be deserialized without validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the --enable-custom-logit-processor option to prevent unauthenticated deserialization of Python objects via dill.loads().
SGLangs multimodal generation runtime --enable-custom-logit-processor = disabled - Compensating control
Restrict network access so the affected SGLangs multimodal generation runtime is not reachable by unauthenticated users capable of triggering the vulnerable code path (especially when the option is enabled).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7304?
CVE-2026-7304 is classified as a critical severity vulnerability due to its potential for unauthenticated remote code execution.
How do I fix CVE-2026-7304?
To mitigate CVE-2026-7304, disable the --enable-custom-logit-processor option or ensure that any deserialized Python objects are properly validated.
Who is affected by CVE-2026-7304?
CVE-2026-7304 affects users of the SGLangs multimodal generation runtime that have enabled the custom logit processor.
What kind of attack can exploit CVE-2026-7304?
CVE-2026-7304 can be exploited by attackers to remotely execute arbitrary code on a vulnerable system.
Is there a patch for CVE-2026-7304?
Currently, there is no official patch for CVE-2026-7304, but it is recommended to follow best practices in securing the application until a fix is released.