Validated Research Published: Aug 5, 2026

SGLang's ZMQ and Pickle Paths Show Why Internal AI Messages Need a Trust Boundary

CERT/CC reported three Python pickle deserialization RCE paths in SGLang: two required optional distributed features enabled and unauthenticated ZeroMQ ports reachable, while the third required an operator to replay a malicious request dump. Because public patch notes and current CNA disclosures disagree on fixed versions, defenders should verify runtime configuration and peer reachability instead of relying only on package version strings.

Remote Code ExecutionAI Deployment SecurityRuntime IsolationAI InfrastructureOpen Source Security
4 applicable AIDEFEND defenses
Source: CERT/CC Vulnerability Note VU#665416: SGLang contains multiple deserialization vulnerabilities 
Author: CERT/CC
Original article: Mar 31, 2026

Threat Analysis

  • Pickle executes code during deserialization. An attacker-controlled payload reaches pickle.loads() or pickle.load() and executes before downstream logic can validate the data structure.
  • Two network paths required specific configurations and exposure. CVE-2026-3059 affected the optional multimodal generation broker, and CVE-2026-3060 affected Encoder Parallel Disaggregation. Both required administrators to enable the feature and leave the unauthenticated ZeroMQ listener reachable from untrusted hosts.
  • The third path required a local operator action. CVE-2026-3989 affected replay_request_dump.py. The attacker must control the dump file or trick an operator into replaying it; this is not an unauthenticated network RCE by itself.
  • Public patch disclosures are inconsistent. CERT/CC and 0.5.10 release notes state the three CVEs are fixed in 0.5.10, but current CNA records still list 0.5.10 as vulnerable. Defenders should verify ZeromQ bind address, cross-node configuration, and reachability in addition to upgrading. There is currently no public evidence that these vulnerabilities have been used in actual attacks.

Applicable AIDEFEND Defenses (4)

AID-H-003.010
Deployed AI Software Vulnerability Remediation Lifecycle
Very High
Inventory the running SGLang package version and image digest; if confirmed vulnerable, upgrade immediately to the supported release. If an immediate upgrade is delayed, temporarily disable affected optional features, rebuild on the fixed version, stage deployment, and verify older workloads have exited. Because public sources conflict on version 0.5.10, runtime config checks and peer connectivity tests are mandatory.
AID-I-002.001
Internal AI Network Segmentation
High
Restrict ZeroMQ ports to required peer IPs with host firewalls and default-deny NetworkPolicy. This blocks untrusted network traffic before it reaches pickle deserialization, even if cross-node configuration overrides the loopback default.
AID-H-004.002
Service & API Authentication
High
Enforce mTLS or workload identity for cross-host broker traffic to require caller authentication and scope access. This removes implicit trust from internal ports, though transport authentication cannot neutralize malicious data from a compromised peer.
AID-I-001.001
Container-Based Isolation
Medium
Run SGLang as non-root with a read-only filesystem, minimal mounts, no production secrets, and resource caps. If deserialization executes code, these boundaries limit file, identity, and lateral access, containing impact rather than fixing the parser.

What Defenders Should Do Now

  • Upgrade to the latest supported SGLang release. Record the package and image digest, then verify the effective ZeroMQ bind address and peer reachability after deployment.
  • Disable multimodal generation or encoder parallel disaggregation when unused. For required cross-node operation, allow only exact workload peers on exact ports and add workload authentication.
  • Locate request-dump directories and the replay_request_dump.py workflow. Prevent low-privilege users and shared jobs from writing those directories, and never replay an untrusted .pkl file.
  • Run the serving process without root, host mounts, or production secrets. Monitor unexpected broker connections, dump creation, child processes, and outbound connections from SGLang workers.
  • Plan to replace pickle on untrusted or network-facing paths with a data-only format and a strict schema. A restricted unpickler is a narrower risk reduction, not a general assurance that arbitrary pickle is safe.

1 additional consideration

Data-only serialization for internal AI brokers

Beyond the mapped remediation, reachability, workload-identity, and containment controls, teams still need a data-only wire protocol and direct proof that every deserialization path rejects executable object graphs.
Recommendation: Replace pickle on network-facing and untrusted file paths with a data-only format and strict schema. Inventory every remaining pickle.load() and pickle.loads() call, document its trust boundary, and require negative tests showing that untrusted bytes cannot select constructors or invoke code.

Conclusion

This case separates three controls that are often conflated. A patch changes the vulnerable product path, network segmentation and workload identity decide who can reach a broker, and runtime isolation limits damage if deserialization still executes code. AIDEFEND  maps these defenses to the boundaries they actually protect, keeping remediation, reachability, identity, and containment responsibilities distinct. The remaining engineering goal is to stop treating pickle and an internal port as implicit trust signals.