Denial of Service Vulnerability in SGLang by Control Messages

CVE-2026-94570

What is CVE-2026-94570?

SGLang is susceptible to a Denial of Service (DoS) vulnerability stemming from inadequate input validation for AUX_DATA ZeroMQ control messages in the Decode worker process. This flaw allows an unauthenticated attacker with network access to the Decode control PULL socket to disrupt the Decode control thread, potentially bringing down the target server and affecting its availability. Proper input validation measures are essential to mitigate this security risk.

References