CVE-2026-14890: SGLang ZeroMQ Unauthenticated RCE via Pickle Deserialization

**CVE-2026-14890 — SGLang insecure deserialization RCE:** A critical (CVSS 9.1) remote code execution vulnerability exists in SGLang's expert-parallel subsystem where an unauthenticated ZeroMQ PULL socket bound to a routable interface deserializes attacker-controlled Python pickle objects, allowing full code execution; the advisory describes the attack vector, affected configurations, and mitigations (firewalling the port, binding to loopback, network controls) but notes no patch referenced in the NVD at publication.