Kritische RCE-Lücke in Sglang (CVE-2026-3060)
⚠️ CVE-Referenzen:
CVE-2026-3059
CVE-2026-3060
Zusammenfassung
Eine kritische Sicherheitslücke in der Deserialisierung von Daten in Sglang ermöglicht Angreifern die Ausführung von beliebigem Code. Die Verwundbarkeit (CVE-2026-3060) betrifft den Disaggregations-Modul des Sglang-Encoders und muss dringend behoben werden, um Systeme vor Kompromittierung zu schützen.
Sglang - Sglang - CRITICAL - CVE-2026-3060.
The SGLang Encoder's disaggregation module is at risk of unauthenticated remote code execution. This occurs due to the unsafe deserialization of untrusted data utilizing the method `pickle.loads()`, which can be exploited by attackers to execute arbitrary code remotely. Ensuring robust validation and authentication mechanisms is crucial to mitigate the risk associated with this vulnerability.
Quelle: securityvulnerability.io