CVE-2026-93838 describes an unbounded memory allocation vulnerability in SGLang versions through 0.5.20. The issue exists in the handle_staging_req() function, which fails to validate the chunk_idx field from ZMQ STAGING_REQ frames used in prefill/decode disaggregation deployments. An attacker with access to the decode engine's internal ZMQ rank port can send a frame with an extremely large chunk_idx value, causing the scheduler to allocate excessive memory until the system runs out of resources and the process is terminated.

Successful exploitation results in denial of service due to resource exhaustion, as the process handling the decode engine will terminate when memory is depleted. There is no indication of privilege escalation or data compromise from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the decode engine's internal ZMQ rank port to trusted entities only to prevent unauthorized exploitation.