CVE-2026-105245: fallo de gravedad media en sgl-project sglang
sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission
Publicada el · Actualizada el
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 6.3epss 0.2%
probabilidad de explotación
0.2%top 91% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function server_info of the file python/sglang/srt/entrypoints/http_server.py of the component HTTP Endpoint. Such manipulation of the argument api_key leads to cleartext transmission of sensitive information. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
sgl-project · sglangPoCs públicas encontradas — 1
cve_referencegithub.com/sgl-project/sglang/issues/30166no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — sgl-project sglang
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-93688HIGHSGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_roomEPSS 0.7%CVE-2026-93838HIGHSGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idxEPSS 0.7%CVE-2026-102634HIGHSGLang through 0.5.20 Denial of Service via Duplicate bootstrap_roomEPSS 0.6%CVE-2026-92972HIGHSGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpointEPSS 0.5%