CVE-2026-110807 in SGLang
Summary
by MITRE • 10/15/2026
A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file python/sglang/srt/managers/io_struct.py of the component generate Endpoint. This manipulation of the argument session_params causes denial of service. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The identified vulnerability in SGLang, specifically within versions up to 0.5.19, represents a critical denial-of-service risk located in the generate Endpoint component. This flaw resides within the file python/sglang/srt/managers/io_struct.py and is triggered by improper handling of session parameters passed during request processing. The core technical issue stems from an inability to adequately validate or sanitize input arguments related to session configuration, allowing malicious actors to supply malformed or excessively large data structures that disrupt normal operational flow. This type of weakness aligns with CWE-20 Improper Input Validation and CWE-400 Uncontrolled Resource Consumption, as the system fails to enforce limits on resource allocation based on user-supplied input.
The operational impact of this vulnerability is severe, primarily manifesting as a denial-of-service condition that can render the service unavailable to legitimate users. By exploiting the manipulation of session parameters, an attacker can cause the server process to crash, enter an infinite loop, or consume excessive memory and CPU resources until it becomes unresponsive. Since the generate Endpoint is typically responsible for handling inference requests in large language model deployments, a successful exploit effectively halts all AI-driven services hosted on that instance. This disruption affects availability, one of the three pillars of the CIA triad, and can lead to significant downtime and loss of service continuity for applications relying on SGLang for real-time generation tasks.
The attack vector is remote, meaning an adversary does not need local access or authentication credentials to initiate the exploit, provided they have network connectivity to the exposed endpoint. The fact that a public exploit has been made available significantly lowers the barrier to entry for attackers, increasing the likelihood of automated scanning and opportunistic attacks against vulnerable instances. This scenario corresponds to ATT&CK technique T1498 Network Denial of Service, where the objective is to impair or deny service to legitimate users by overwhelming system resources. The lack of a response from the project maintainers despite early notification via issue reports exacerbates the risk, leaving deployed systems exposed until an official patch is released and applied.
Mitigation strategies should focus on immediate defensive measures given the absence of a vendor-provided fix. Administrators should implement strict input validation at the network perimeter using Web Application Firewalls to filter out malformed session parameter payloads before they reach the application layer. Rate limiting and connection throttling can also help mitigate the impact by preventing any single source from overwhelming the service with rapid, malicious requests. Additionally, deploying resource monitoring tools that detect abnormal spikes in memory or CPU usage associated with specific endpoints can facilitate early detection and automated isolation of compromised instances. Until a patched version is available, restricting access to the generate Endpoint through IP whitelisting or authentication mechanisms where possible will reduce the attack surface exposed to remote adversaries.