CVE-2026-15976
CVE-2026-15976
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.load(..., weights_only=False) fallback enables pickle deserialization of .bin files.
| Vendor | sglang |
| Product | sglang |
| Published | Jul 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for sglang sglang
Be the first to know when new unknown vulnerabilities affecting sglang sglang are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
SGLang / SGLang
0 ≤ v0.5.15