CVE-2026-15976
CVE-2026-15976
CVSS Score
9.8
EPSS Score
0.3%
EPSS Percentile
18th
SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.load(..., weights_only=False) fallback enables pickle deserialization of .bin files.
| Vendor | sglang |
| Product | sglang |
| Published | Jul 30, 2026 |
| Last Updated | Jul 31, 2026 |
Stay Ahead of the Next One
Get instant alerts for sglang sglang
Be the first to know when new critical vulnerabilities affecting sglang sglang are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
SGLang / SGLang
0 ≤ v0.5.15