Executive brief
SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor
Affected products
- PyPI sglang
Junglewise Threat Intelligence
CVE-2025-10164: PYSEC-2026-1919 - SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor
CVE-2025-10164 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: sglang (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-3062 - SGLang has an Improper Input Validation/Injection Issue
- PYSEC-2026-539 - SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker
- PYSEC-2026-537 - SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module
- sgl-project SGLang denial of service in Cache Handler
- SGLang reachable assertion in LoRA manager scheduler admission