sgl-project vulnerabilities

Newest CVEs

• CVE-2026-112270

  SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx

  sgl-project · sglang

  High7.1
• CVE-2026-112269

  SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations

  sgl-project · sglang

  High7.1
• CVE-2026-112268

  sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes

  sgl-project · sglang-router

  Medium5.3
• CVE-2026-112267

  SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker

  sgl-project · sglang

  Medium6.9
• CVE-2026-112266

  SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching

  sgl-project · sglang

  High8.2
• CVE-2026-112083

  sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service

  sgl-project · SGLang

  Medium6.9
• CVE-2026-112082

  sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service

  sgl-project · SGLang

  High8.7
• CVE-2026-111392

  SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate

  sgl-project · sglang

  Medium6.3
• CVE-2026-111391

  SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter

  sgl-project · sglang

  Critical9.2
• CVE-2026-110809

  sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service

  sgl-project · SGLang

  Medium5.3