CVE-2026-3059 - Vulnerability Analysis

Overview

SGLang multimodal generation module contains a remote code execution caused by unauthenticated deserialization of untrusted data using pickle.loads() in ZMQ broker, letting unauthenticated attackers execute arbitrary code remotely.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary code remotely, potentially leading to full system compromise.

Mitigation

Update to the latest version with secure deserialization or apply patches to authenticate data before deserialization.

References

• https://orca.security/resources/blog/sglang-llm-framework-rce-vulnerabilities/
• https://github.com/sgl-project/sglang/blob/main/python/sglang/multimodal_gen/runtime/scheduler_client.py
• https://github.com/sgl-project/sglang/security/advisories/GHSA-3cp7-c6q2-94xr

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 12, 2026

🔴 CVE-2026-3059 - Critical (9.8) SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3059/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner