{"schema_version":"1","data":[{"id":15720,"advisory_id":"c99e4a25-156f-452a-88a6-5fdd38b3bfc5","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93034","source_published_at":"2026-10-08T14:00:09.084+00:00","published_at":"2026-10-25T01:04:46.122615+00:00","extraction_method":"structured","technologies":["core-cve","sglang"],"cve_ids":["CVE-2026-93034"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"CVE-2026-93034","summary":"SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when SGLANG_USE_PICKLE_IPC is disabled, and becomes remotely exploitable if data-parallel attention is enabled with a non-loopback --dist-init-addr setting.","evidence":"cve:CVE-2026-93034","products":[{"name":{"value":"SGLang","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-93034","aliases":["CVE-2026-93034"],"metrics":[],"affected":[{"vendor":"SGLang","product":"SGLang","versions":[{"status":"affected","version":"0","versionType":"custom","lessThanOrEqual":"v0.5.20"}]}],"modified":"2026-10-08T20:22:35.805Z","provider":"cve","references":["https://github.com/sgl-project/sglang/tree/main","https://m00dy.sh/notes/disabling-pickle-did-not-remove-pickle?palette=mineral"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-93034","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-08T20:22:09.915843Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-502","description":"CWE-502 Deserialization of Untrusted Data"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T20:22:35.805Z"}}],"cna":{"orgId":"37e5125f-f79b-445b-8fad-9564f167944b","shortName":"certcc","dateUpdated":"2026-10-08T14:00:09.084Z"}}},"related_cves":[{"value":"CVE-2026-93034","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}}],"next_after":15720,"next_before":15720}