CVE-2026-112083: Denial of Service in sgl-project SGLang
Description
A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send_weights_to_remote_instance of the file python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of the component Weight Exporter. Performing a manipulation of the argument group_name results in denial of service. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
CVSS v4.0
Score 6.9medium
Affected software
sgl-project
SGLang
pkg:github/sgl-project/sglangcpe:2.3:a:sgl-project:sglang:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the Weight Exporter component of sgl-project SGLang up to version 0.5.19, specifically the function WeightExporter.send_weights_to_remote_instance in the file python/sglang/srt/model_executor/model_runner_components/weight_exporter.py. By manipulating the argument group_name, an attacker can trigger a denial of service condition remotely. The exploit code has been publicly released. A pull request containing a fix is pending acceptance, indicating no official patch is currently available.
Potential Impact
An unauthenticated remote attacker can cause a denial of service in the affected versions of sgl-project SGLang by manipulating the group_name argument in the WeightExporter.send_weights_to_remote_instance function. This can disrupt service availability but does not indicate privilege escalation or data compromise.
Mitigation Recommendations
No official patch is currently available as the fix is pending acceptance in a pull request. Users should monitor the vendor's repository or advisory channels for the acceptance of the fix and apply it promptly once released. Until then, consider restricting access to the vulnerable service to trusted networks to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-18T14:26:48.148Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad5af532cdf04f65614c8b8
Added to database: 10/19/2026, 05:49:07 UTC
Last enriched: 10/19/2026, 06:03:23 UTC
Last updated: 10/19/2026, 19:06:46 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.