CVE-2026-102634 in SGLang
Summary
by MITRE • 09/29/2026
SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstrap_room values to crash scheduler processes or hang other users' requests until transfer timeout.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in SGLang versions through 0.5.20 represents a critical flaw within the prefill and decode disaggregation architecture, specifically when utilizing the Mooncake Key-Value (KV) transfer backend. This system design separates the computational heavy lifting of generating initial tokens from the subsequent decoding phases to optimize resource utilization and latency in large language model serving environments. The core technical failure lies in the input validation logic governing the /generate endpoint requests. Specifically, the application fails to enforce uniqueness constraints on the bootstrap_room field when processing concurrent incoming requests that specify identical values for this parameter. In a distributed inference setup, the bootstrap room serves as an identifier for shared memory or network resources used during the initial phase of request handling. When multiple unauthenticated actors submit simultaneous requests with duplicate bootstrap_room identifiers, the system's internal state management mechanisms become corrupted due to race conditions and resource contention issues that are not properly serialized or isolated.
This lack of validation allows attackers to trigger a denial-of-service condition against both the scheduler processes and other legitimate users of the service. By flooding the endpoint with concurrent requests sharing the same bootstrap_room value, an attacker can cause the scheduler processes to crash due to unhandled exceptions arising from conflicting resource allocations. Alternatively, if the system does not immediately crash, it may enter a hung state where subsequent requests are blocked waiting for resources that have been improperly locked or corrupted by the duplicate entries. This effectively hangs other users' requests until the transfer timeout is reached, resulting in significant service disruption and potential data loss depending on the transactional nature of the pending operations. The impact is severe because it requires no authentication, allowing any network-accessible entity to exploit this flaw without prior credentials.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the application accepts malformed or logically inconsistent input data that violates expected business logic constraints regarding resource identifiers. Furthermore, in terms of tactical mapping within the MITRE ATT&CK framework, this behavior is consistent with T1499 Endpoint Denial of Service, where an attacker disrupts availability by exhausting system resources or causing process failures through specific application-level exploits rather than network-layer flooding alone. The exploitation vector leverages the asynchronous nature of the KV transfer backend to amplify the impact of concurrent requests, making it a potent tool for disrupting high-throughput inference services.
Mitigation strategies must focus on implementing strict input validation at the API gateway or request handling layer before any stateful operations are initiated. Developers should enforce uniqueness checks on the bootstrap_room field within single transactional contexts or implement locking mechanisms to prevent race conditions when multiple requests target the same resource identifier. Additionally, rate limiting and connection pooling adjustments can help mitigate the impact of concurrent flood attacks while a permanent code fix is deployed. Upgrading to a patched version of SGLang that addresses this validation gap in the Mooncake KV transfer backend integration is essential for restoring service integrity and preventing unauthorized disruption of inference capabilities.