CVE-2026-15971 | Vulnetix

CVE-2026-15971 PUBLISHED CVSS 9.8 CRITICAL

Reported by certcc · Published July 30, 2026

SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests.

Risk Scores

CVSS 3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
SGLang	SGLang	0
SGLang	SGLang	0, 0

Timeline

Jul 30, 2026 CVE Published
Jul 31, 2026 Coalition ESS Score
Jul 31, 2026 CVE Updated
Aug 3, 2026 Security Advisory
Aug 7, 2026 EPSS Score

References

Open in Interactive Console →