CVE-2026-15976 | Vulnetix

CVE-2026-15976 PUBLISHED CVSS 9.8 CRITICAL

Reported by certcc · Published July 30, 2026

SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.load(..., weights_only=False) fallback enables pickle deserialization of .bin files.

Risk Scores

CVSS 3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
SGLang	SGLang	0
SGLang	SGLang	0, 0

Timeline

Jul 30, 2026 CVE Published
Jul 31, 2026 Coalition ESS Score
Aug 3, 2026 Security Advisory
Aug 4, 2026 CVE Updated
Aug 7, 2026 EPSS Score

References

Open in Interactive Console →