[Auto-Update] sglang 0.5.15 (#6382)

* [Auto-Update] sglang 0.5.15

* security(sglang): allowlist CVE-2026-39822 (go/stdlib in mooncake), dedupe

CVE-2026-39822: go/stdlib 1.25.9 in mooncake libetcd_wrapper.so, needs
Go 1.26.5, not patchable without upstream mooncake rebuild. Same class as
existing mooncake entries. Also remove a duplicate CVE-2026-27145 entry.

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Kevin Wang <kwanggg@amazon.com>

Author: 3 people

.github/config/image/sglang/ec2-ubuntu.yml

@@ -3,7 +3,7 @@ image:
   description: "SGLang for EC2 instances (Ubuntu, upstream base image)"
 metadata:
   framework: "sglang"
-  framework_version: "0.5.14"
+  framework_version: "0.5.15"
   os_version: "ubuntu24.04"
   customer_type: "ec2"
   arch_type: "x86"
@@ -13,7 +13,7 @@ metadata:
 build:
   dockerfile: "docker/sglang/Dockerfile"
   target: "sglang-ec2"
-  base_image: "lmsysorg/sglang:v0.5.14"
+  base_image: "lmsysorg/sglang:v0.5.15"
   python_version: "3.12"
   cuda_version: "13.0.3"
   efa_version: "1.48.0"

.github/config/image/sglang/sagemaker-ubuntu.yml

@@ -3,7 +3,7 @@ image:
   description: "SGLang for SageMaker (Ubuntu, upstream base image)"
 metadata:
   framework: "sglang"
-  framework_version: "0.5.14"
+  framework_version: "0.5.15"
   os_version: "ubuntu24.04"
   customer_type: "sagemaker"
   platform: "sagemaker"
@@ -14,7 +14,7 @@ metadata:
 build:
   dockerfile: "docker/sglang/Dockerfile"
   target: "sglang-sagemaker"
-  base_image: "lmsysorg/sglang:v0.5.14"
+  base_image: "lmsysorg/sglang:v0.5.15"
   python_version: "3.12"
   cuda_version: "13.0.3"
   efa_version: "1.48.0"

docker/sglang/Dockerfile

@@ -1,6 +1,6 @@
 # Declare the argument as default to use as input
 # base image: https://hub.docker.com/r/lmsysorg/sglang/tags
-ARG BASE_IMAGE=lmsysorg/sglang:v0.5.14
+ARG BASE_IMAGE=lmsysorg/sglang:v0.5.15
 
 # Use input argument as base image
 FROM $BASE_IMAGE AS base

test/security/data/ecr_scan_allowlist/sglang/framework_allowlist.json

@@ -34,6 +34,11 @@
         "reason": "go/stdlib 1.25.9 embedded in mooncake libetcd_wrapper.so, MIME header parsing CPU exhaustion, cannot patch without upstream mooncake rebuild with Go 1.26.4+",
         "review_by": "2026-09-10"
     },
+    {
+        "vulnerability_id": "CVE-2026-39822",
+        "reason": "go/stdlib 1.25.9 embedded in mooncake libetcd_wrapper.so, cannot patch without upstream mooncake rebuild with Go 1.26.5+",
+        "review_by": "2026-09-10"
+    },
     {
         "vulnerability_id": "RUSTSEC-2026-0195",
         "reason": "quick-xml 0.39.2 is bundled inside the uv binary at /usr/local/bin/uv (uv is statically compiled Rust). Advisory is a denial-of-service in NsReader's namespace resolution during Start/Empty XML event handling; the vulnerable code path is only reachable when uv parses attacker-controlled XML (e.g. a hostile PyPI mirror index). uv is retained in the image for customer-side venv management; the standard PyPI flow uses JSON/HTML endpoints and never exercises the XML path. No uv release containing the patched quick-xml>=0.41.0 has been published upstream yet; will swap to a pinned fixed version and drop this entry when upstream ships.",
@@ -53,10 +58,5 @@
         "vulnerability_id": "GHSA-36hh-v3qg-5jq4",
         "reason": "pyo3 0.23.5 in upstream sglang sglang-grpc Cargo.lock, cannot patch without upstream sglang rebuild",
         "review_by": "2026-09-10"
-    },
-    {
-        "vulnerability_id": "CVE-2026-27145",
-        "reason": "go/stdlib 1.25.9 embedded in mooncake libetcd_wrapper.so, x509 VerifyHostname CPU exhaustion, cannot patch without upstream mooncake rebuild with Go 1.26.4+",
-        "review_by": "2026-09-10"
     }
 ]