PT-2026-45663

CVE-2026-10300

Published

2026-06-01

Updated

2026-07-22

Description by

CVSS 3.1

3.7

Low

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions SGLang version 0.5.10.post1

Description An issue exists within the Inference HTTP Endpoint component in the file python/sglang/srt/lora/lora manager.py. Remote manipulation of the lora path argument can trigger a reachable assertion. This attack is characterized by high complexity and is considered difficult to exploit.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Zyz3366

Vendors

Affected products

Weakness enumeration

CWE-617: Reachable Assertion

Related identifiers

CVE-2026-10300