CVE-2026-15976: Lmsys Sglang

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.load(..., weights_only=False) fallback enables pickle deserialization of .bin files.

Affected products

• Lmsys Sglang: up to and including 0.5.15

Published 2026-07-30. Last modified 2026-08-04.