TLDRVuln - Cybersecurity Vulnerabilities Made Simple

CVE-2026-3060

Critical · published March 12, 2026

CVSS v3.1

9.8

EPSS

Percentile

74.1

In the wild

Unconfirmed

What it is

SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication.

The record

Technical detail

CVSS v3.1: 9.8 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.01501 · 74.1th percentile
Published: 2026-03-12T11:37Z

EPSS history

Timeline

12 MAR 11:37Z
CVE-2026-3060
cvelistv5