VulnSocial

CVE-2026-93034

LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

Back to dashboard
0.0/ 10 priority

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Peaked 1d ago at 1 mentions (2026-10-09); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-10-09: 1Mentions · 2026-10-10: 110-0910-10
Referenced assets1 URL
Full discourse2 posts
  • Upwind Security MDR@UpwindMDR

    🚨Critical - SGLang ZMQ PickleWrapper Deserialization RCE (CVE-2026-93034) SGLang’s ZMQ message decoder deserializes PickleWrapper payloads via pickle.loads() without auth/allowlisting; the gadget path persists via msgpack even when SGLANG_USE_PICKLE_IPC is disabled. With data-parallel attention enabled and --dist-init-addr set to a non-loopback address, remote peers can trigger arbitrary code execution. 👉Affected: SGLang (all versions with ZMQ IPC / dist attention enabled)

    0000047
    315 followersView on X
  • Severity Daily@severitydaily

    SGLang's off switch for pickle IPC swaps the envelope for MessagePack and still reaches pickle.loads. The record stops at 0.5.20; the 0.5.21 wheel is identical. No exploitation reported. https://severitydaily.com/sglang-cve-2026-93034-use-pickle-ipc-off-switch-msgpack-pickle-loads-0-5-21-identical/

    0000018
    33 followersView on X

Explore more

Back to dashboard