Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-93034

Quick assessment

Affected
SGLang SGLang
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SGLang 存在一个任意代码执行漏洞，该漏洞源于 ZMQ 消息解码器在未进行类型白名单校验或身份认证的情况下，无条件地通过 函数中的 对 载荷进行反序列化。即使禁用了 ，该漏洞仍可通过 msgpack 路径持续存在。此外，当启用数据并行注意力机制（data-parallel attention）且 参数设置为非回环地址时，此漏洞可被远程利用。

AI Predicted 8.6 Difficulty: Moderate EPSS 0.46% · P38

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
SGLang SGLang ≤ v0.5.20 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93034

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CVE-2026-93034
Source: CVE Program / CVE List V5
Vulnerability Description
SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when SGLANG_USE_PICKLE_IPC is disabled, and becomes remotely exploitable if data-parallel attention is enabled with a non-loopback --dist-init-addr setting.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
SGLang SGLang 0 ~ v0.5.20 -

II. Public POCs for CVE-2026-93034

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93034

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-93034 (1)

Vendor Pages for CVE-2026-93034 (1)

IV. Related Vulnerabilities

Same product: SGLang
Same vendor: SGLang

V. Comments for CVE-2026-93034

No comments yet

Leave a comment