Threats affecting pkg:pypi/sglang

SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGING_RSP messages with huge chunk_idx values under fresh room IDs, causing the scheduler to be OOM-killed.

CVE-2026-112269 is a denial of service vulnerability in SGLang through version 0.5.22 when using the Mooncake disaggregation backend. It arises from accepting unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing network-adjacent attackers to exhaust memory by sending many unique registrations with large nested-buffer frames. This can cause the scheduler to be killed due to out-of-memory conditions.

CVE-2026-112267 is a server-side request forgery (SSRF) vulnerability in sglang versions up to 0.5.22. It occurs in the prefill/decode disaggregation mode, allowing unauthenticated attackers to make outbound requests by manipulating bootstrap_host and bootstrap_port fields. Exploiting this flaw, attackers can probe internal network hosts and ports and cause delays by blocking the shared scheduler loop, impacting inference request processing.

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates all other clients' requests.

SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure endpoint when DUMPER_SERVER_PORT is set, running code in the scheduler process on the next forward pass.

CVE-2026-110807 is a denial of service vulnerability in the sgl-project SGLang affecting versions 0.5.0 through 0.5.19. The issue arises from manipulation of the session_params argument in the generate Endpoint component, specifically in the file python/sglang/srt/managers/io_struct.py. The vulnerability can be exploited remotely without user interaction and requires low attack complexity and privileges. Although exploit code is publicly available, the project has not yet responded with a fix.

SGLang versions up to 0.5.21 have a denial of service vulnerability caused by disabling Pillow's decompression bomb protection. This occurs because the Image.MAX_IMAGE_PIXELS setting is set to None in NanoNemotronVLImageProcessor, allowing remote attackers to submit small but highly compressed images with very large dimensions. This can exhaust worker memory during image decoding, leading to denial of service.

SGLang versions up to 0.5.21 have a resource allocation vulnerability allowing remote attackers to bypass video processing limits by manipulating parameters in the video_url object. This can cause excessive memory consumption and denial of service.

SGLang versions up to 0.5.21 have a vulnerability in the preprocess_video function of qwen_vl.py that allows unbounded memory allocation. This occurs because frames are decoded at full source resolution before max_pixels limits are applied. Remote attackers can exploit this by submitting high-resolution videos to the /v1/chat/completions endpoint, causing concurrent requests to exhaust worker memory and result in denial of service.

SGLang versions up to 0.5.21 have a vulnerability in the load_audio function where highly compressed audio data can be decompressed into very large PCM buffers without limits on duration or sample size. This allows remote attackers to cause denial of service by exhausting memory and CPU resources.

SGLang versions up to 0.5.21 have a vulnerability allowing unauthenticated remote attackers to exhaust server memory by uploading oversized files to the /v1/audio/transcriptions endpoint. This leads to denial of service by crashing the HTTP/tokenizer worker due to unbounded memory allocation.

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstrap_room values to crash scheduler processes or hang other users' requests until transfer timeout.

SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefill/decode disaggregation deployments. Attackers with access to the decode engine's internal ZMQ rank port can send a frame with an extremely large chunk_idx value, causing the scheduler to allocate memory until the system runs out and terminates the process.

SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine's POST /generate endpoint and submit arbitrary bootstrap_room values to exhaust prefill process memory until out-of-memory termination.

SGLang versions up to 0.5.9 contain a vulnerability in the get_tokenizer function of the HuggingFace Transformer Handler component. This flaw involves improper input validation leading to deserialization issues. The vulnerability can be exploited remotely but requires high attack complexity and no privileges or user interaction. The vendor has not responded to disclosure attempts, and no patch is currently available.