CVE-2026-110809 in SGLang
Summary
by MITRE • 10/15/2026
A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.create_req of the file python/sglang/srt/session/session_controller.py of the component Session Cleanup. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The SGLang project, a framework designed for efficient large language model serving, contains a critical security vulnerability within its session management subsystem as of version 0.5.19. Specifically, the flaw resides in the Session.create_req function located in the python/sglang/srt/session/session_controller.py file. This component is responsible for handling the initialization and lifecycle management of client sessions during inference requests. The vulnerability manifests when an attacker interacts with this endpoint using malformed or specifically crafted inputs that exploit improper validation logic within the session controller. Because the issue affects core infrastructure components, it allows a remote adversary to trigger conditions that destabilize the server process without requiring authentication in many default configurations, thereby enabling unauthenticated exploitation from across network boundaries.
The technical nature of this flaw centers on inadequate input sanitization and state management errors during request creation. When malicious data is passed to the create_req function, it can cause memory corruption, infinite loops, or resource exhaustion within the Python runtime environment hosting SGLang. This leads directly to a denial of service condition where the LLM serving instance becomes unresponsive or crashes entirely. The operational impact is severe for any production deployment relying on continuous availability for inference tasks. Service interruptions result in dropped requests, increased latency for legitimate users, and potential data inconsistency if transactions are interrupted mid-execution. Given that SGLang is often deployed in high-throughput environments, even brief outages can have significant downstream effects on applications dependent on real-time AI responses.
From a threat intelligence perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-400 Uncontrolled Resource Consumption, as the exploit leverages poorly validated inputs to exhaust system resources or crash the application process. In terms of attack vectors, it corresponds to MITRE ATT&CK technique T1499 Endpoint Denial of Service, specifically under subcategories involving resource exhaustion via service disruption. The fact that an exploit has been publicly disclosed and is actively usable indicates a heightened risk landscape where automated scanning tools or opportunistic attackers may target instances running vulnerable versions. Organizations must treat this as a high-priority issue due to the ease of exploitation and the criticality of availability in AI serving workloads.
Mitigation strategies should focus on immediate remediation through version upgrades once the pending pull request is merged into an official release. Until then, administrators can implement network-level controls such as rate limiting or IP whitelisting for session endpoints to reduce exposure to untrusted sources. Additionally, deploying Web Application Firewalls with rules tuned to detect anomalous patterns in session creation requests may provide temporary protection against known exploit signatures. It is also advisable to monitor system logs for signs of process crashes or abnormal memory usage spikes associated with the session controller module. Regular security audits and dependency updates are essential to maintain resilience against evolving threats targeting machine learning infrastructure components.