CVE-2026-112266 in SGLang
Summary
by MITRE • 10/19/2026
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates all other clients' requests.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The SGLang framework, specifically through version 0.5.22, contains a critical denial of service vulnerability rooted in flawed request identification and termination logic within its API handling mechanisms. This flaw allows malicious actors to disrupt the availability of services for legitimate users by exploiting how unique identifiers are matched against incoming abort commands. The core issue lies in the implementation of the rid parameter, which is intended to uniquely identify specific generation requests initiated by clients. In a properly secured system, this identifier should be sufficiently complex and globally unique to prevent collisions or ambiguous matches that could inadvertently target unintended processes. However, due to insufficient validation constraints on the length and format of client-supplied rids, attackers can manipulate these identifiers to create broad matching patterns rather than precise ones.
The technical flaw manifests when an attacker submits a streaming /generate request using a single hexadecimal character as the rid value. Because the underlying abort logic employs prefix-matching algorithms to locate and terminate specific in-flight requests, this short identifier acts as a wildcard that matches any other active session sharing that initial hex digit. Since there are only sixteen possible values for a single hexadecimal character (0 through f), an attacker can systematically target large segments of concurrent users by cycling through these minimal identifiers. When the malicious client disconnects after submitting such a request, it triggers the abort mechanism prematurely and broadly, causing the server to terminate all other active generation requests that share the same prefix identifier. This results in immediate data loss for affected users and forces them to restart their operations from scratch.
From an operational perspective, this vulnerability significantly impacts service reliability and user trust. In multi-tenant environments where SGLang is deployed as a shared inference engine, such behavior can lead to widespread outages affecting numerous unrelated parties simultaneously. The ability of one actor to disrupt the work of many others without requiring authentication or elevated privileges represents a severe degradation of availability guarantees. This type of attack does not necessarily consume excessive computational resources in terms of CPU cycles but rather wastes allocated memory and GPU time by initiating requests that are immediately aborted, thereby reducing overall throughput efficiency. Furthermore, it creates an unpredictable environment where users cannot rely on the stability of their long-running generation tasks, which is particularly detrimental for applications involving complex reasoning or large-scale text synthesis.
This vulnerability aligns with CWE-787: Out-of-bounds Write in terms of logical scope mismanagement and more accurately reflects CWE-693: Protection Mechanism Failure where the system fails to prevent access by unauthorized actors due to flawed logic design. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1499: Endpoint Denial of Service, specifically under techniques that involve resource exhaustion or service disruption through application-level exploitation rather than network flooding. The attack vector is classified as Network Access with Low Complexity, indicating it can be executed remotely by an unauthenticated adversary using standard HTTP requests.
To mitigate this vulnerability, developers and system administrators must enforce strict validation rules on the rid parameter to ensure uniqueness and prevent prefix-based collisions. Implementing UUIDs or cryptographically secure random strings for request identifiers would eliminate the possibility of short-prefix matching errors. Additionally, introducing rate limiting per client IP address can help curb rapid-fire abort requests that attempt to cascade disruptions across multiple sessions. Server-side logic should also be reviewed to ensure that abort commands require explicit confirmation or are scoped strictly to the originating session unless explicitly authorized otherwise by an administrator role. Upgrading to patched versions of SGLang where this logical flaw has been addressed is essential for restoring service integrity and preventing further exploitation in production environments.