Live › vulnerability › CVE-2026-112082
Go to dashboardSGLang <= 0.5.19: /start_, /stop_ and /dump_expert_distribution_record (GET or POST) are registered on every server. On a server started without --expert-distribution-recorder-mode (the default), a single request raises an uncaught exception in the scheduler process. The scheduler dies and the whole server exits. A PoC is in the public issue. Fix PR #42098 is open and unmerged; no fixed release yet.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running SGLang up to version 0.5.19 are affected, since the flaw is in its expert-distribution recording endpoint. Whether that endpoint is reachable from outside depends on the deployment, which the sources do not say.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| sglang | pypi | >= 0.5.0, <= 0.5.19 | – |
pip show sglang (affected: 0.5.0 to 0.5.19)curl -X POST http://HOST:PORT/dump_expert_distribution_record on a test server kills it0.5.19 includes it; unknown which versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
This page as .md · .json · in your agent: get_signal("CVE-2026-112082")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.