CVE-2026-94570 — MEDIUM (5.9)

Vulnerability Description

SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial of service against the target server.

CVSS Score

5.9

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Related Weaknesses (CWE)

CWE-1287

References

https://gist.github.com/yyymk/b5892625cb5efa2bffd36e0b05334ae8

FAQ

What is CVE-2026-94570?

CVE-2026-94570 is a vulnerability with a CVSS score of 5.9 (MEDIUM). SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachabi...

How severe is CVE-2026-94570?

CVE-2026-94570 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-94570?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.