TLDRVuln - Cybersecurity Vulnerabilities Made Simple

CVE-2026-3059

Critical · published March 12, 2026

CVSS v3.1

9.8

EPSS

Percentile

74.1

In the wild

Unconfirmed

What it is

SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication.

The record

Technical detail

CVSS v3.1: 9.8 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.01501 · 74.1th percentile
Published: 2026-03-12T11:37Z

EPSS history

Timeline

12 MAR 11:37Z
CVE-2026-3059
cvelistv5