CVE-2026-14890 — CVE-2026-14890
SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deserialization safegua…
Published: 2026-07-16 · CVSS: 9.1 · CVSS 3.1
SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deserialization safeguards, allowing an attacker to provide a malicious pickle file that results in unauthenticated remote code execution when the feature is enabled and the service is reachable over the network.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7