Critical CVEs Affecting AI Inference Services: CVE-2026-93688 and CVE-2026-92983

• •CVE-2026-93688 and CVE-2026-92983 allow unauthenticated memory exhaustion attacks.
• •Both vulnerabilities pose high availability risks for AI inference services.
• •Immediate patching and monitoring are crucial for affected organizations.

Two high-priority vulnerabilities have been identified in AI inference services: CVE-2026-93688 in SGLang and CVE-2026-92983 in InternLM. Both vulnerabilities allow unauthenticated attackers to exploit exposed endpoints, leading to denial of service through memory exhaustion. CVE-2026-93688 affects SGLang versions up to 0.5.19, while CVE-2026-92983 impacts InternLM LMDeploy versions up to 0.17.0. Attackers can submit arbitrary requests to exhaust memory, disrupting model serving and dependent applications. The vulnerabilities are not currently classified as actively exploited, but organizations using these systems should take immediate action to mitigate risks. Monitoring for unusual request patterns and applying vendor patches are recommended. The vulnerabilities were published on September 18 and September 17, 2026, respectively.