SGLang versions up to 0.5.9 contain a vulnerability in the get_tokenizer function of the HuggingFace Transformer Handler component. This flaw involves improper input validation leading to deserialization issues. The vulnerability can be exploited remotely but requires high attack complexity and no privileges or user interaction. The vendor has not responded to disclosure attempts, and no patch is currently available.