CVE-2026-112266Medium· 5.9▾ TwilightPoC availableSGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests wi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 32.5 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates all other clients' requests.
sglang <= 0.5.22Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111392Medium· 4.8SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate
CVE-2026-111391High· 8.1SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter
CVE-2026-110809Medium· 4.3A security vulnerability has been detected in sgl-project SGLang up to 0.5.19
CVE-2026-110807Medium· 4.3A weakness has been identified in sgl-project SGLang up to 0.5.19
CVE-2026-109227High· 7.5SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits
CVE-2026-109229High· 7.5SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor