VDB
CVE-2026-93088
CVE-2026-93088
PUBLISHED
CVSS 9.8 CRITICAL
Reported by certcc · Published September 22, 2026
SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the final frame of received multipart messages directly to pickle.loads() before any validation occurs.
Risk Scores
CVSS 3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| SGLang | SGLang | 0.5.11 |
| SGLang | SGLang | 0.5.11 |
Timeline
- Sep 22, 2026 CVE Published
- Sep 22, 2026 CVE Updated
- Sep 23, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
- Sep 26, 2026 EPSS Score
- Sep 30, 2026 EPSS Score
- Oct 2, 2026 EPSS Score
- Oct 6, 2026 EPSS Score
- Oct 8, 2026 EPSS Score
- Oct 11, 2026 EPSS Score
- Oct 14, 2026 EPSS Score
- Oct 16, 2026 EPSS Score