SGLang versions up to 0.5.19 contain an unauthenticated PUT /route endpoint in the prefill bootstrap service operating in decode disaggregation mode. Attackers can exploit this endpoint to inject arbitrary rank_ip and rank_port values, thereby poisoning the KV transfer routing table. This manipulation redirects decode workers to attacker-controlled endpoints, potentially causing denial of service or leakage of KV transfer metadata including session identifiers and tensor-parallel topology parameters. The vulnerability has a CVSS 4.0 base score of 8.8, indicating high severity with network attack vector, no privileges required, no user interaction, and high impact on availability and moderate impact on confidentiality and integrity.

The vulnerability allows unauthenticated remote attackers to redirect decode workers to malicious endpoints, resulting in denial of service or unauthorized disclosure of sensitive KV transfer metadata such as session identifiers and tensor-parallel topology parameters. This can disrupt normal operation and compromise confidentiality of internal data flows.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the PUT /route endpoint and monitor for suspicious activity targeting this service. Implement network-level controls to limit exposure of the prefill bootstrap service to trusted entities only.