CVE-2026-93034: SGLang SGLang vulnerability

Published Oct 8, 2026

Updated

SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in maybeunwrappickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when SGLANGUSEPICKLEIPC is disabled, and becomes remotely exploitable if data-parallel attention is enabled with a non-loopback --dist-init-addr setting.

Affected Software

1 affected component

SGLang SGLang

Event History

Oct 8, 2026

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionWeakness

Frequently Asked Questions

When is this remotely exploitable?

Remote exploitation becomes possible when data-parallel attention is enabled and --dist-init-addr is configured with a non-loopback address. In that configuration, an attacker able to send crafted messages to the exposed distributed initialization endpoint can trigger pickle deserialization.

Does disabling SGLANG_USE_PICKLE_IPC mitigate the issue?

No. The vulnerable PickleWrapper deserialization remains reachable through the msgpack path even when SGLANG_USE_PICKLE_IPC is disabled.

What can be done if patching is not immediately possible?

Avoid enabling data-parallel attention with a non-loopback --dist-init-addr. Restrict the distributed initialization address to loopback where possible, and prevent untrusted hosts from reaching the relevant messaging interface.

CVE-2026-93034: SGLang SGLang vulnerability

Affected Software

Event History

Frequently Asked Questions

When is this remotely exploitable?

Does disabling SGLANG_USE_PICKLE_IPC mitigate the issue?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

When is this remotely exploitable?

Does disabling SGLANG_USE_PICKLE_IPC mitigate the issue?

What can be done if patching is not immediately possible?