{"id":"CVE-2026-112082","kind":"vulnerability","aliases":["CVE-2026-112082"],"related":[],"title":"SGLang: remote requests to expert-distribution endpoint cause denial of service","description":"A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.","summary":"SGLang <= 0.5.19: /start_, /stop_ and /dump_expert_distribution_record (GET or POST) are registered on every server. On a server started without --expert-distribution-recorder-mode (the default), a single request raises an uncaught exception in the scheduler process. The scheduler dies and the whole server exits. A PoC is in the public issue. Fix PR #42098 is open and unmerged; no fixed release yet.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sglang","fixed":[],"affected":">= 0.5.0, <= 0.5.19","ecosystem":"pypi"}],"ecosystems":[],"tags":["ai-tooling","denial-of-service","http-api","llm-serving","python","sglang","unauthenticated"],"not_affected_if":["auth-required","blocked-at-proxy","not-internet-exposed"],"how_to_check":"Run 'pip show sglang' (affected: 0.5.0 to 0.5.19). Check whether the launch command lacks --expert-distribution-recorder-mode and whether the HTTP port is reachable by untrusted clients or has no --api-key. Do not test on production: 'curl -X POST http://HOST:PORT/dump_expert_distribution_record' on a test server kills it.","fix":"No fixed release as of 2026-10-25. Fix is PR sgl-project/sglang#42098 (open): it returns HTTP 400 when the recorder is disabled. Upgrade once a release past 0.5.19 includes it; unknown which version.","status":"open","published_at":"2026-10-19T06:17:23+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:10:20+00:00","updated_at":"2026-10-25T03:14:07+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-25T03:10:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SGLang: remote requests to expert-distribution endpoint cause denial of service","impact":"medium","summary":"SGLang up to 0.5.19 has a flaw in the Scheduler.expert_distribution_handle function, in the expert-distribution recording endpoint. A remote request can make the service fail, which is a denial of service.","category":"ai-tooling","nicknames":[],"who_cares":["sglang","llm-serving","python"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote requests crash the scheduler, taking model serving offline.","analyst_note":"Find the fixed SGLang release or merged pull request past 0.5.19, and confirm whether the endpoint is enabled by default, via the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-112082.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running SGLang up to version 0.5.19 are affected, since the flaw is in its expert-distribution recording endpoint. Whether that endpoint is reachable from outside depends on the deployment, which the sources do not say.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.001037,"input_tokens":3359,"output_tokens":1403,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed SGLang release or merged pull request past 0.5.19, and confirm whether the endpoint is enabled by default, via the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-112082.","search":"'-112082':15A,18A '-2026':14A,17A '/dump_expert_distribution_record':41B '/start_':38B '/stop_':39B '0.5.19':37B,110C '42098':90B 'accept':162C 'ai':21B 'ai-tool':20B 'api':29B 'attack':143C 'avail':149C 'await':161C 'caus':9A 'compon':124C 'cve':13A,16A 'default':61B 'denial':10A,24B,134C 'denial-of-servic':23B 'die':75B 'distribut':7A,57B,116C,127C 'endpoint':8A,129C 'everi':48B 'except':68B 'exit':80B 'expert':6A,56B,126C 'expert-distribut':5A,125C 'expert-distribution-recorder-mod':55B 'exploit':146C 'file':120C 'fix':88B,96B,158C 'function':114C 'get':42B 'handl':117C 'http':28B 'http-api':27B 'identifi':102C 'impact':112C 'issu':87B,160C 'launch':141C 'lead':132C 'llm':31B 'llm-serv':30B 'manipul':131C 'might':151C 'mode':59B 'open':92B 'poc':82B 'possibl':139C 'post':44B 'pr':89B 'process':72B 'project':106C 'public':86B,148C 'pull':155C 'python':33B 'python/sglang/srt/eplb/expert_distribution.py':121C 'rais':65B 'record':58B,128C 'regist':46B 'releas':97B 'remot':2A,144C 'request':3A,64B,156C 'schedul':71B,74B 'scheduler.expert':115C 'serv':32B 'server':49B,52B,79B 'servic':12A,26B,136C 'sgl':105C 'sgl-project':104C 'sglang':1A,19A,34B,36B,107C 'singl':63B 'start':53B 'tool':22B 'unauthent':35B 'uncaught':67B 'unmerg':94B 'use':153C 'vulner':100C 'whole':78B 'without':54B 'yet':98B","nicknames":[],"mitigations":[],"who_affected":"Teams running SGLang up to version 0.5.19 are affected, since the flaw is in its expert-distribution recording endpoint. Whether that endpoint is reachable from outside depends on the deployment, which the sources do not say.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T06:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-112082","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112082","severity":null,"published_at":"2026-10-19T06:17:23+00:00","modified_at":"2026-10-19T17:17:11+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112082:674","url":null,"severity":null,"published_at":"2026-10-25T03:14:07+00:00","modified_at":"2026-10-25T03:14:07+00:00","first_seen_at":"2026-10-25T03:14:07+00:00","fetched_at":"2026-10-25T03:14:07+00:00","note":"Read maintainer issue #42071 (reporter's repro) and fix PR #42098 (still open, unmerged as of 2026-10-25); no fixed release exists past 0.5.19. Endpoints are registered on every server, default config affected. Nothing marked verified: no vendor advisory, only an issue and an open PR."}],"documents":[{"id":3075,"url":"https://github.com/sgl-project/sglang/issues/42071","title":"[Bug] expert_distribution_record routes kill the server without --expert-distribution-recorder-mode (#42071)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3077,"url":"https://github.com/sgl-project/sglang/pull/42098","title":"PR #42098 Reject disabled expert recorder controls before scheduler dispatch (open)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":3078,"url":"https://www.cve.org/CVERecord?id=CVE-2026-112082","title":"CVE Record CVE-2026-112082","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}