Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

sgl-project/sglang

              main @ d5e9176
            

Fixes

CVEs

CRITICAL

Peak severity

36.8%

Coverage

Highlights

Denial of Service: 25 prior fixes. Scrutinize any change in this area.

python/sglang/srt/managers/tokenizer_manager.py: most-fixed (6 issues). Treat as high-risk during review.

20 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Deserialization of Untrusted Data: The application relies on deserializing IPC or network payloads. Standard Python pickle/dill usage led to multiple critical vulnerabilities (CVE-2025-10164, CVE-2026-3059, CVE-2026-3060). Malicious payloads sent to internal or exposed sockets can achieve full Remote Code Execution. Solid sandboxing with safe unpickling allowlists is vital.

Sandbox Bypass: Rendering user-controlled, model-provided, or custom chat/tokenizer templates using standard Jinja2 Environments allows template injection and execution of arbitrary system commands. This is illustrated in CVE-2026-5760.

Denial of Service: The TokenizerManager and scheduler are vulnerable to state-desynchronization, unhandled key errors, and memory leaks. Duplicate request IDs, ambiguous multi-element tensor truthiness, and uncleaned state dictionaries during abort events repeatedly cause process crashes or resource exhaustion.