SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization

The primary impact of CVE-2026-3989 is remote code execution (RCE). An attacker can craft a malicious pickle file that, when loaded by the vulnerable script, will execute arbitrary commands on the target system. This could lead to complete system compromise, including data theft, malware installation, and denial of service. The scope of the impact depends on the privileges of the user running the replayrequestdump.py script. If run as root or with elevated privileges, the attacker gains significant control over the system. This vulnerability shares similarities with other insecure deserialization flaws where untrusted data is directly deserialized without proper validation, potentially leading to arbitrary code execution.

Systems running SGLangs versions 0.5.9 and earlier, particularly those where the replayrequestdump.py script is used to process data from external or untrusted sources, are at significant risk. Shared hosting environments where multiple users have access to the same SGLangs installation are also particularly vulnerable.

• python / script:

import os
import hashlib

def check_pkl_integrity(filepath):
    """Checks the integrity of a pickle file using SHA256.
    Args:
        filepath (str): Path to the pickle file.
    Returns:
        bool: True if the file is valid, False otherwise.
    """
    try:
        with open(filepath, 'rb') as f:
            data = f.read()
            sha256_hash = hashlib.sha256(data).hexdigest()
            # Replace with expected hash value
            expected_hash = 'your_expected_hash_here'
            return sha256_hash == expected_hash
    except Exception as e:
        print(f"Error checking file: {e}")
        return False

# Example usage
filepath = 'path/to/your/file.pkl'
if check_pkl_integrity(filepath):
    print("File integrity is valid.")
else:
    print("File integrity is compromised.")

• generic web: Check for the presence of replayrequestdump.py in publicly accessible directories. Monitor access logs for requests to this script, especially those originating from untrusted sources.

1. 2026-03-12Disclosure

   disclosure

1. आरक्षित2026-03-11
2. प्रकाशित2026-03-12
3. संशोधित2026-04-07
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-3989 is to upgrade SGLangs to version 0.5.10 or later, which includes the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. Strictly validate the source of any .pkl files before processing them with replayrequestdump.py. Avoid loading pickle files from untrusted sources entirely. Consider using alternative serialization formats like JSON or YAML, which are generally safer and less prone to arbitrary code execution vulnerabilities. Implement input validation to ensure that the pickle file conforms to expected structure and content.