CVE-2026-112266: Partial String Comparison in sgl-project sglang
Description
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates all other clients' requests.
CVSS v4.0
Score 8.2high
Affected software
sgl-project
sglang
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-112266 describes a denial of service vulnerability in SGLang through version 0.5.22. The vulnerability arises from partial string comparison logic in the API's request abort mechanism. Attackers can submit streaming /generate requests with very short rids (single hex characters) and disconnect, causing the prefix-matching abort logic to terminate all other clients' in-flight generation requests that share the prefix. This allows an attacker to disrupt service for other users by aborting their requests.
Potential Impact
An attacker can cause denial of service by aborting other users' active generation requests, disrupting normal service operation and availability. This affects all clients using the affected versions of SGLang up to 0.5.22.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using short rids or implement additional validation to prevent prefix-based abort logic from affecting unrelated requests.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-19T13:25:24.402Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad623792cdf04f6565c8805
Added to database: 10/19/2026, 14:04:41 UTC
Last enriched: 10/19/2026, 14:18:25 UTC
Last updated: 10/19/2026, 19:06:47 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.