CVE-2026-94570: SGLang DoS Vulnerability via ZeroMQ Messages

CVE-2026-94570 Overview

CVE-2026-94570 is a denial of service vulnerability in SGLang, a serving framework for large language models. The flaw stems from missing input validation on AUX_DATA ZeroMQ control messages processed by the Decode worker. An unauthenticated remote attacker with network reachability to the Decode control PULL socket can send crafted messages that terminate the Decode control thread, taking the target server offline. The issue is tracked under CWE-1287: Improper Validation of Specified Type of Input.

Critical Impact
Any network-adjacent attacker who can reach the Decode control PULL socket can crash the SGLang Decode worker without authentication, disrupting model inference availability.

Affected Products

SGLang serving framework — Decode worker component
Deployments exposing the Decode control PULL socket on reachable network interfaces
Distributed SGLang topologies using ZeroMQ for inter-worker control messaging

Discovery Timeline

2026-09-22 - CVE-2026-94570 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94570

Vulnerability Analysis

SGLang uses ZeroMQ sockets for control-plane messaging between worker roles. The Decode worker exposes a PULL socket that receives control messages, including AUX_DATA frames. The handler that dispatches AUX_DATA messages does not validate the message structure, types, or field contents before processing.

When a malformed AUX_DATA message reaches the handler, deserialization or downstream processing raises an unhandled exception. The exception propagates out of the Decode control thread, terminating it. Once the control thread exits, the Decode worker can no longer service inference requests, producing a sustained denial of service against the model server.

The attack requires network reachability to the PULL socket but no credentials or user interaction. Exploitation depends on how the ZeroMQ endpoint is bound. Deployments that bind the socket to a public interface or an untrusted internal network are directly exposed.

Root Cause

The root cause is missing type and schema validation on inbound ZeroMQ control messages. The Decode worker trusts the wire format of AUX_DATA payloads and does not enforce structural constraints before dispatching them to internal handlers. This maps to [CWE-1287], improper validation of specified type of input.

Attack Vector

The attacker connects to the Decode control PULL socket over the network and pushes a crafted AUX_DATA message. The message deviates from the expected schema in a way that causes an exception inside the control thread. No authentication step gates the socket, so a single malformed message is sufficient to terminate the thread.

A public proof of concept is available in the GitHub Gist PoC Repository. Consult the advisory for the exact message layout used to trigger the crash.

Detection Methods for CVE-2026-94570

Indicators of Compromise

Abrupt termination of the SGLang Decode control thread without a corresponding administrative action
Unhandled exceptions in Decode worker logs referencing AUX_DATA handling or ZeroMQ deserialization
Inbound TCP connections to Decode control PULL socket ports from unexpected source addresses
Sudden loss of inference throughput on Decode workers coinciding with control-plane traffic spikes

Detection Strategies

Monitor SGLang worker process supervisors for repeated Decode thread restarts or worker exits
Alert on stack traces in Python logs that reference the AUX_DATA control message dispatcher
Baseline the set of source IPs that legitimately reach ZeroMQ control sockets and alert on deviations
Correlate inference API latency and error rate spikes with worker control-plane events

Monitoring Recommendations

Ship SGLang worker logs and process metrics to a centralized analytics platform for retention and query
Track ZeroMQ socket connection counts and message rates per endpoint to detect abuse
Enable health probes that fail closed when the Decode control thread is not running
Review network flow logs for connections to Decode control ports originating outside trusted subnets

How to Mitigate CVE-2026-94570

Immediate Actions Required

Restrict network reachability to the Decode control PULL socket using firewall rules or security groups
Bind ZeroMQ control sockets to loopback or a dedicated private management interface, not to public interfaces
Audit all SGLang deployments for exposed ZeroMQ endpoints and remove unnecessary exposure
Enable process supervision that restarts Decode workers on crash to reduce outage duration while patching

Patch Information

At the time of publication, no fixed version is listed in the NVD record. Monitor the SGLang project repository for a patched release that adds validation to the AUX_DATA control message handler. Track the GitHub Gist PoC Repository reference in the CVE entry for links to upstream fixes as they publish.

Workarounds

Place SGLang Decode workers behind a network segment that is unreachable from user-facing networks
Terminate inference client traffic at an authenticated proxy and disallow direct client access to worker control planes
Apply host-based firewall rules that only permit ZeroMQ traffic from known Prefill and orchestrator hosts
If control-plane authentication is available in the deployment, enable it and rotate keys used between workers

bash

# Example iptables rule restricting Decode control port to a trusted orchestrator host
# Replace <DECODE_CTRL_PORT> and <ORCHESTRATOR_IP> with deployment-specific values
iptables -A INPUT -p tcp --dport <DECODE_CTRL_PORT> -s <ORCHESTRATOR_IP> -j ACCEPT
iptables -A INPUT -p tcp --dport <DECODE_CTRL_PORT> -j DROP