S
Vendor security profile
sgl-project
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs10
Critical0
CISA KEV0
Public exploit5
Patch rate%10
Avg. CVSS8.4
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
0
4
6
CVE KEV
CVE severity distribution
10toplam CVE
High9 (90%)
Medium1 (10%)
Patch and exploitation view
%10
Verified patch
%0
CISA KEV
%50
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
9Unknown
Latest vulnerabilities
8.7
CVE-2026-109229
SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor
S
Patch status unknownEPSS %0
8.7
CVE-2026-109228
SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters
S
Patch status unknownEPSS %0
8.7
CVE-2026-109227
SGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Video Preprocessing
S
Patch status unknownEPSS %0
8.7
CVE-2026-109226
SGLang through 0.5.21 Audio Decompression Amplification via load_audio
S
Patch status unknownEPSS %0
8.7
CVE-2026-109225
SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload
S
Patch status unknownEPSS %0
6.3
CVE-2026-105245
sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission
S
Patch verifiedEPSS %0
8.7
CVE-2026-102634
SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room
S
Patch status unknownEPSS %1
8.2
CVE-2026-93838
SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx
S
Patch status unknownEPSS %1
8.7
CVE-2026-93688
SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room
S
Patch status unknownEPSS %1
8.8
CVE-2026-92972
SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint
S
Patch status unknownEPSS %0