| शीर्षक | SGLang Project SGLang(SGLang Runtime) 0.5.19 Remote Denial of Service |
|---|
| विवरण | SGLang 0.5.19 contains a denial-of-service vulnerability in session replacement, implemented in Session.create_req within python/sglang/srt/session/session_controller.py.
During cleanup of a non-empty session, the implementation iterates over a request-node dictionary while SessionReqNode.clear removes entries from that same dictionary. This invalidates the active iteration and raises a RuntimeError in the scheduler.
The failure is not isolated to the triggering request. The reported behavior is SIGQUIT-driven shutdown of the serving instance, followed by an unreachable health endpoint. A remote client with access to the session-generation API can consequently cause service-wide denial of service. |
|---|
| स्रोत | ⚠️ https://github.com/sgl-project/sglang/issues/41470 |
|---|
| उपयोगकर्ता | Zyz3366 (UID 97230) |
|---|
| सबमिशन | 28/09/2026 08:46 PM (28 दिन पहले) |
|---|
| संयम | 14/10/2026 08:20 PM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 420279 [sgl-project SGLang तक 0.5.19 Session Cleanup session_controller.py Session.create_req सेवा अस्वीकार] |
|---|
| अंक | 20 |
|---|