CVE-2026-112270
CVE-2026-112270 · SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGING_RSP messages with huge chunk_idx values under fresh room IDs, causing the scheduler to be OOM-killed.
CVSS 7.1 · Alta · EPSS 0,2%
- Publicación
- Actualización
Productos y versiones afectados
sglang
- Versiones
- ≥ 0, ≤ 0.5.22: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/sgl-project/sglang/issues/45014
- https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/disaggregation/common/staging_handler.py#L505-L548
- https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/disaggregation/mooncake/conn.py#L2885-L2935
- https://www.vulncheck.com/advisories/sglang-through-0.5.22-memory-exhaustion-via-mooncake-staging-rsp-chunk-idx
- https://nvd.nist.gov/vuln/detail/CVE-2026-112270