CVE-2026-93034

SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads in maybeunwrappickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when...

EUVD-2026-94989

SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads in maybeunwrappickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when...

CVE-2026-93034 CVE-2026-93034

SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads in maybeunwrappickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when...

CVE-2026-93034

SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads in maybeunwrappickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when...

CVE-2026-93034 CVE-2026-93034

SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads in maybeunwrappickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when...

CVE-2026-93034

SGLang is affected by an arbitrary code execution vulnerability originating from the ZMQ message decoder . The root cause is the unconditional deserialization of PickleWrapper payloads using pickle.loads() within the _maybe_unwrap_pickle function, which lacks type allowlisting or authentication. ...

CVE-2026-93034: Deserialization of Untrusted Data

SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads in maybeunwrappickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when...

PT-2026-108017

Name of the Vulnerable Software and Affected Versions SGLang affected versions not specified Description An arbitrary code execution issue exists due to the ZMQ message decoder unconditionally deserializing PickleWrapper payloads using the pickle.loads function within maybe unwrap pickle without...