Live › vulnerability › CVE-2026-111392
Go to dashboardSGLang through 0.5.21 uses caller-supplied mm_hashes values as the cache key for multimodal prefix caching. An attacker sending a crafted request to /generate can get another request's cached image content disclosed or corrupt the victim's responses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running SGLang with multimodal (image) models where /generate is reachable by callers other than trusted internal clients, because those callers can supply the mm_hashes cache key. Deployments that are text-only or accept requests only from trusted sources are less exposed. Sources do not say which model types or configurations are required.
No product ranges from the sources yet.
pip show sglang and compare it to the fixed release listed in the sources (unknown).0.5.21 to the release that fixes this (exact version unknown; check the NVD entry).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash via /generate to disclose another request's image content or corrupt victims' responses.
This page as .md · .json · in your agent: get_signal("CVE-2026-111392")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.