Executive brief
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module
Affected products
- PyPI sglang
Junglewise Threat Intelligence
CVE-2026-3060: PYSEC-2026-537 - SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module
CVE-2026-3060 · Severity: low · CVSS 3.1 · Published 2026-06-29
Technologies: sglang (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-3062 - SGLang has an Improper Input Validation/Injection Issue
- PYSEC-2026-1919 - SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor
- PYSEC-2026-539 - SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker
- sgl-project SGLang denial of service in Cache Handler
- SGLang reachable assertion in LoRA manager scheduler admission