Threat Intelligence Database

SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash via /generate to disclose another request's image content or corrupt victims' responses.

A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.create_req of the file python/sglang/srt/session/session_controller.py of the component Session Cleanup. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.

CVE-2026-105245 is a medium severity vulnerability in sgl-project sglang up to version 0.5.21. It involves cleartext transmission of sensitive information via the api_key argument in the HTTP Endpoint component's server_info function. The vulnerability can be exploited remotely but requires a high level of attack complexity. A fix has been developed but is pending acceptance in a pull request.

CVE-2026-92972 is a high-severity vulnerability in SGLang up to version 0.5.19. It involves a missing authentication check on a critical PUT /route endpoint in the prefill bootstrap service when operating in decode disaggregation mode. This flaw allows unauthenticated attackers to poison the key-value transfer routing table by supplying arbitrary rank_ip and rank_port values. Exploitation can lead to denial of service or disclosure of sensitive metadata such as session identifiers and tensor-parallel topology parameters.

A vulnerability was determined in sgl-project SGLang up to 0.5.11. Affected by this vulnerability is the function data_hash of the component Cache Handler. This manipulation causes denial of service. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.