SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGING_RSP messages with huge chunk_idx values under fresh room IDs, causing the scheduler to be OOM-killed.
SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations with unique mooncake_session_id values and large nested-buffer frames to exhaust Prefill memory until the scheduler is OOM-killed.
sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/* endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped configuration, change global rate limits, and call POST /ha/shutdown to silently dissolve HA coordination.
SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstrap_host and bootstrap_port fields. Attackers sending crafted requests to the Decode worker's /generate endpoint can probe internal hosts and ports and block the shared scheduler loop, delaying other inference requests.
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates all other clients' requests.
A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send_weights_to_remote_instance of the file python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of the component Weight Exporter. Performing a manipulation of the argument group_name results in denial of service. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash via /generate to disclose another request's image content or corrupt victims' responses.
SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure endpoint when DUMPER_SERVER_PORT is set, running code in the scheduler process on the next forward pass.
CVE-2026-110809 is a denial of service vulnerability in sgl-project SGLang affecting versions 0.5.0 through 0.5.19. The flaw exists in the Session.create_req function within the Session Cleanup component. The vulnerability can be exploited remotely without user interaction and requires low privileges. A public exploit is available, but a fix is pending acceptance of a pull request.
CVE-2026-110807 is a denial of service vulnerability in the sgl-project SGLang affecting versions 0.5.0 through 0.5.19. The issue arises from manipulation of the session_params argument in the generate Endpoint component, specifically in the file python/sglang/srt/managers/io_struct.py. The vulnerability can be exploited remotely without user interaction and requires low attack complexity and privileges. Although exploit code is publicly available, the project has not yet responded with a fix.
SGLang versions up to 0.5.21 have a denial of service vulnerability caused by disabling Pillow's decompression bomb protection. This occurs because the Image.MAX_IMAGE_PIXELS setting is set to None in NanoNemotronVLImageProcessor, allowing remote attackers to submit small but highly compressed images with very large dimensions. This can exhaust worker memory during image decoding, leading to denial of service.
SGLang versions up to 0.5.21 have a resource allocation vulnerability allowing remote attackers to bypass video processing limits by manipulating parameters in the video_url object. This can cause excessive memory consumption and denial of service.
SGLang versions up to 0.5.21 have a vulnerability in the preprocess_video function of qwen_vl.py that allows unbounded memory allocation. This occurs because frames are decoded at full source resolution before max_pixels limits are applied. Remote attackers can exploit this by submitting high-resolution videos to the /v1/chat/completions endpoint, causing concurrent requests to exhaust worker memory and result in denial of service.
SGLang versions up to 0.5.21 have a vulnerability in the load_audio function where highly compressed audio data can be decompressed into very large PCM buffers without limits on duration or sample size. This allows remote attackers to cause denial of service by exhausting memory and CPU resources.
SGLang versions up to 0.5.21 have a vulnerability allowing unauthenticated remote attackers to exhaust server memory by uploading oversized files to the /v1/audio/transcriptions endpoint. This leads to denial of service by crashing the HTTP/tokenizer worker due to unbounded memory allocation.
CVE-2026-105245 is a medium severity vulnerability in sgl-project sglang up to version 0.5.21. It involves cleartext transmission of sensitive information via the api_key argument in the HTTP Endpoint component's server_info function. The vulnerability can be exploited remotely but requires a high level of attack complexity. A fix has been developed but is pending acceptance in a pull request.
SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstrap_room values to crash scheduler processes or hang other users' requests until transfer timeout.
SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefill/decode disaggregation deployments. Attackers with access to the decode engine's internal ZMQ rank port can send a frame with an extremely large chunk_idx value, causing the scheduler to allocate memory until the system runs out and terminates the process.
SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine's POST /generate endpoint and submit arbitrary bootstrap_room values to exhaust prefill process memory until out-of-memory termination.