SGLang's diffusion server runs code sent by anyone who can reach its port

What happened

CVE-2026-93088, published on 22 September 2026 and scored CVSS 3.1 9.8, is unauthenticated remote code execution in SGLang's disaggregated-diffusion orchestrator: its DiffusionServer binds a ZeroMQ ROUTER socket to a network interface with no authentication and passes the last frame of each message straight to Python's pickle.loads(). Researcher Keita Sode of SYZD Research reported it on 3 July, and his write-up names 0.5.11 as the first affected release and 0.5.20, released on 18 September, as still affected.

Four denial-of-service records against SGLang's prefill/decode disaggregation code landed the same week: CVE-2026-92972 (17 September, 8.6), an unauthenticated PUT /route that rewrites the KV-transfer routing table; CVE-2026-93688 (18 September, 7.5), unbounded bootstrap_room allocation through the decode engine's /generate endpoint; CVE-2026-93838 (18 September, 5.9), unbounded allocation from a ZeroMQ chunk_idx; and CVE-2026-94570 (22 September, 5.9), unvalidated AUX_DATA control messages that stop the decode control thread. Until a fixed release ships, the researcher advises restricting the scheduler port and its neighbours to trusted addresses. A sixth record followed on 29 September: CVE-2026-102634 (7.5), where concurrent /generate requests carrying the same bootstrap_room value crash scheduler processes or hang other users' requests on the Mooncake transfer backend, through 0.5.20. SGLang 0.5.21 reached PyPI on 1 October 2026; no fix for CVE-2026-93088 was confirmed as of 2 October.