---
id: "CVE-2026-112082"
kind: "vulnerability"
aliases: ["CVE-2026-112082"]
title: "SGLang: remote requests to expert-distribution endpoint cause denial of service"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "sglang", "fixed": [], "affected": ">= 0.5.0, <= 0.5.19", "ecosystem": "pypi"}]
ecosystems: []
tags: ["ai-tooling", "denial-of-service", "http-api", "llm-serving", "python", "sglang", "unauthenticated"]
not_affected_if: ["auth-required", "blocked-at-proxy", "not-internet-exposed"]
published_at: "2026-10-19T06:17:23+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:14:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112082", "first_seen_at": "2026-10-23T21:57:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:14:07+00:00"}]
---

# SGLang: remote requests to expert-distribution endpoint cause denial of service

SGLang <= 0.5.19: /start_, /stop_ and /dump_expert_distribution_record (GET or POST) are registered on every server. On a server started without --expert-distribution-recorder-mode (the default), a single request raises an uncaught exception in the scheduler process. The scheduler dies and the whole server exits. A PoC is in the public issue. Fix PR #42098 is open and unmerged; no fixed release yet.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:sglang affected >= 0.5.0, <= 0.5.19 fixed ?

## How to check

Run 'pip show sglang' (affected: 0.5.0 to 0.5.19). Check whether the launch command lacks --expert-distribution-recorder-mode and whether the HTTP port is reachable by untrusted clients or has no --api-key. Do not test on production: 'curl -X POST http://HOST:PORT/dump_expert_distribution_record' on a test server kills it.

## Fix

No fixed release as of 2026-10-25. Fix is PR sgl-project/sglang#42098 (open): it returns HTTP 400 when the recorder is disabled. Upgrade once a release past 0.5.19 includes it; unknown which version.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112082
- 2026-10-25T03:14:07+00:00 analyst — Read maintainer issue #42071 (reporter's repro) and fix PR #42098 (still open, unmerged as of 2026-10-25); no fixed release exists past 0.5.19. Endpoints are registered on every server, default config affected. Nothing marked verified: no vendor advisory, only an issue and an open PR.

## Documents

- [advisory] CVE Record CVE-2026-112082 https://www.cve.org/CVERecord?id=CVE-2026-112082
- [fix] PR #42098 Reject disabled expert recorder controls before scheduler dispatch (open) https://github.com/sgl-project/sglang/pull/42098
- [poc] [Bug] expert_distribution_record routes kill the server without --expert-distribution-recorder-mode (#42071) https://github.com/sgl-project/sglang/issues/42071

## From the sources

A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_