CVE-2026-105245: falha de média gravidade em sgl-project sglang
sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission
Publicada em · Atualizada em
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 6.3epss 0.2%
probabilidade de exploração
0.2%top 91% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function server_info of the file python/sglang/srt/entrypoints/http_server.py of the component HTTP Endpoint. Such manipulation of the argument api_key leads to cleartext transmission of sensitive information. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Produtos afetados
sgl-project · sglangPoCs públicas encontradas — 1
cve_referencegithub.com/sgl-project/sglang/issues/30166não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — sgl-project sglang
No mesmo produto, das mais perigosas para as menos.
CVE-2026-93688HIGHSGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_roomEPSS 0.7%CVE-2026-93838HIGHSGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idxEPSS 0.7%CVE-2026-102634HIGHSGLang through 0.5.20 Denial of Service via Duplicate bootstrap_roomEPSS 0.6%CVE-2026-92972HIGHSGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpointEPSS 0.5%