The vulnerability in sglang through version 0.5.20 arises from improper validation of duplicate bootstrap_room fields in /generate requests under the Mooncake KV transfer backend during prefill/decode disaggregation mode. An attacker without authentication can exploit this by sending multiple concurrent requests with the same bootstrap_room identifier, leading to scheduler process crashes or request hangs until the transfer timeout is reached. This denial-of-service condition affects the availability of the service.

Exploitation of this vulnerability results in denial-of-service conditions by crashing scheduler processes or causing request hangs for other users until the transfer timeout. The attack requires no authentication and can disrupt normal service operation, impacting availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing request rate limiting or input validation controls to detect and block duplicate bootstrap_room values in /generate requests if feasible.