CVE-2026-94570
CVE-2026-94570
- State
- Published
- Severity
- 5.9 Medium
- Published
- Sep 22, 2026
- Updated
- Sep 22, 2026
- Reserved
- Sep 21, 2026
Description
SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial of service against the target server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.9 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
Weaknesses
- CWE-1287 Improper Validation of Specified Type of Input
Affected Products
| Product | Versions |
|---|---|
SGLangSGLang |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.