CVE-2026-112270
CVE-2026-112270 · SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGING_RSP messages with huge chunk_idx values under fresh room IDs, causing the scheduler to be OOM-killed.
CVSS 7.1 · Hoch · EPSS 0,2%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
sglang
- Softwareversionen
- ≥ 0, ≤ 0.5.22: Betroffen (semver)
Keine Korrektur veröffentlicht
Originalquellen
- https://github.com/sgl-project/sglang/issues/45014
- https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/disaggregation/common/staging_handler.py#L505-L548
- https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/disaggregation/mooncake/conn.py#L2885-L2935
- https://www.vulncheck.com/advisories/sglang-through-0.5.22-memory-exhaustion-via-mooncake-staging-rsp-chunk-idx
- https://nvd.nist.gov/vuln/detail/CVE-2026-112270