Executive Summary

CVE-2025-10164 is a critical security flaw in lmsys sglang version 0.4.6, specifically in the function main of the /update_weights_from_tensor endpoint. The vulnerability arises because the application deserializes untrusted input from the serialized_named_tensors argument using Python's pickle module without proper validation. This allows an attacker to remotely execute arbitrary code on the server by sending specially crafted serialized data, leading to remote code execution (RCE). The vulnerability is exploitable without authentication and has a publicly available proof-of-concept exploit. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized remote code execution on the affected system. An attacker can execute arbitrary commands or obtain a reverse shell, potentially leading to full system compromise. This affects the confidentiality, integrity, and availability of the system running the vulnerable Sglang service. Since the exploit can be launched remotely without authentication, it poses a high risk to any exposed deployments of the affected software. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring HTTP POST requests to the endpoint /update_weights_from_tensor on port 3456 (default). You can look for suspicious POST requests containing the field serialized_named_tensors with base64-encoded pickle serialized strings. To verify exploitation, check server logs for command outputs such as 'RCE-Exploit-By-Simon@360!'. A detection command example using curl to test the endpoint with a benign payload is: curl --location --request POST 'http://<server-ip>:3456/update_weights_from_tensor' \ --header 'Content-Type: application/json' \ --data-raw '{"serialized_named_tensors": ["<base64-encoded string>"], "flush_cache": true}' Monitoring network traffic for such POST requests or using intrusion detection systems to flag deserialization attempts on this endpoint can help detect exploitation attempts. [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling or restricting access to the /update_weights_from_tensor endpoint to prevent remote exploitation. Since no patches or vendor mitigations are available, it is recommended to replace the affected Sglang version 0.4.6 with an alternative or earlier safe version if available. Additionally, implement network-level controls such as firewall rules to block incoming traffic to port 3456 or the vulnerable endpoint. Monitoring and alerting on suspicious POST requests to this endpoint is also advised. [1, 2]

Useful 0 Not Useful 0