PatchTheCVECVE-2026-10775: A vulnerability was determined in sgl-project SGLang up to 0.5.11
CVE-2026-10775 is a low-severity flaw (CVSS 3.6) affecting sglang. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability was determined in sgl-project SGLang up to 0.5.11. Affected by this vulnerability is the function data_hash of the component Cache Handler. This manipulation causes denial of service. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits accept
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 3.6 (Low) |
| Attack vector | Local |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.1% (top 98%) |
| CISA exploited list | No |
| Weakness | CWE-404 |
| Published | 2026-06-03 |
| Last modified | 2026-07-22 |
Last updated 2026-07-22 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-10775?
sglang: upgrade to newer than 0.5.11. Exact commands for each OS are on this page.
Is CVE-2026-10775 being exploited?
CVE-2026-10775 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-10775 affect?
CVE-2026-10775 affects sglang. Severity is low (CVSS 3.6). A vulnerability was determined in sgl-project SGLang up to 0.5.11. Affected by this vulnerability is the function data_hash of the component Cache Handler. This manipulation causes denial of service. The attack is restricted to local execut
How urgent is CVE-2026-10775?
Priority 13/100. No elevated risk signals yet.
Related CVEs
- CVE-2026-14890 CRITICAL 9.1 UPGRADE SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interf
- CVE-2026-15969 CRITICAL 9.8 UPGRADE SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomp
- CVE-2026-15971 CRITICAL 9.8 UPGRADE SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox esc
- CVE-2026-15974 MEDIUM 6.5 UPGRADE SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to
- CVE-2026-15976 CRITICAL 9.8 UPGRADE SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, speci