{"id":"CVE-2026-112083","kind":"vulnerability","aliases":["CVE-2026-112083"],"related":[],"title":"SGLang: weight exporter group_name argument allows remote denial of service","description":"A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send_weights_to_remote_instance of the file python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of the component Weight Exporter. Performing a manipulation of the argument group_name results in denial of service. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.","summary":"SGLang's /send_weights_to_remote_instance endpoint crashes the whole server with one request if no weight-send group was initialised first. The code subscripts a dict (KeyError) instead of using .get(), so the scheduler process dies. Without --api-key anyone who can reach the port can trigger it. A PoC is public; no exploitation reported.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sglang","fixed":[],"affected":">= 0.5.0, <= 0.5.19","ecosystem":"pypi"}],"ecosystems":[],"tags":["ai-tooling","llm-serving","python","self-hosted","sglang"],"not_affected_if":["api-key-set","auth-required","private-network-only"],"how_to_check":"- pip show sglang: versions 0.5.0 to 0.5.19 are listed as affected (0.5.20+ unconfirmed, check whether the fix PR is in your build)\n- In your install, check weight_exporter.py: if it has self._weights_send_group[group_name] is not None (around line 93) rather than .get(), it is vulnerable\n- Check whether the server was launched without --api-key and whether its port is reachable from untrusted networks","fix":"No released fix as of 2026-10-25. Upstream PR sgl-project/sglang#42093 (also #42096) is open and unmerged; it changes the guard to .get() so the request returns a 400. Until a release includes it: start the server with --api-key, keep the API port off untrusted networks, and block POST /send_weights_to_remote_instance at the proxy if you do not use remote weight transfer.","status":"open","published_at":"2026-10-19T06:17:23+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:12:54+00:00","updated_at":"2026-10-25T04:13:59+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-25T04:12:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SGLang: weight exporter group_name argument allows remote denial of service","impact":"low","summary":"SGLang, an LLM serving framework, has a flaw in WeightExporter.send_weights_to_remote_instance where a manipulated group_name argument can crash or stall the service. An attacker who can reach the endpoint can cause a denial of service, and the exploit is public.","category":"ai-tooling","nicknames":[],"who_cares":["sglang","python","self-hosted","llm-serving"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote attacker crashes or stalls the SGLang inference service","analyst_note":"Sources do not name a fixed version or whether the weight export endpoint is enabled by default; check the NVD and the upstream SGLang pull request for the patched release and default configuration.","how_to_check":"- Check the installed SGLang version with `pip show sglang` and compare it to the affected range up to `0.5.19`\n- Look for the weight exporter code path in `python/sglang/srt/model_executor/model_runner_components/weight_exporter.py` in your deployed copy\n- Confirm whether the server's API port is reachable from untrusted networks","needs_analyst":true,"not_affected_if":["private-network-only","auth-required"],"who_is_affected":"Teams running SGLang up to version 0.5.19 that expose the serving API beyond a trusted network are exposed, since the flaw is triggered remotely through the weight export path. Deployments that keep the service on a private network or behind authentication have a smaller exposure. unknown whether the vulnerable path is enabled by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000641,"input_tokens":3376,"output_tokens":606,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Sources do not name a fixed version or whether the weight export endpoint is enabled by default; check the NVD and the upstream SGLang pull request for the patched release and default configuration.","search":"'-112083':14A,17A '-2026':13A,16A '/send_weights_to_remote_instance':32B '0.5.19':98C 'accept':158C 'affect':99C 'ai':20B 'ai-tool':19B 'allow':7A 'anyon':69B 'api':67B 'api-key':66B 'argument':6A,122C 'attack':131C,149C 'await':157C 'code':51B 'compon':114C 'crash':34B 'cve':12A,15A 'denial':9A,127C 'dict':54B 'die':64B 'discov':90C 'endpoint':33B 'exploit':83B,137C 'export':3A,116C 'file':110C 'first':49B 'fix':154C 'flaw':87C 'function':102C 'get':59B 'group':4A,46B,123C 'host':28B 'initi':134C 'initialis':48B 'instanc':107C 'instead':56B 'issu':156C 'key':68B 'keyerror':55B 'llm':23B 'llm-serv':22B 'manipul':119C 'may':145C 'name':5A,124C 'one':39B 'perform':117C 'poc':79B 'port':74B 'process':63B 'project':94C 'public':81B,143C 'pull':151C 'python':25B 'python/sglang/srt/model_executor/model_runner_components/weight_exporter.py':111C 'reach':72B 'releas':140C 'remot':8A,106C,135C 'report':84B 'request':40B,152C 'result':125C 'schedul':62B 'secur':86C 'self':27B 'self-host':26B 'send':45B 'serv':24B 'server':37B 'servic':11A,129C 'sgl':93C 'sgl-project':92C 'sglang':1A,18A,29B,30B,95C 'subscript':52B 'tool':21B 'trigger':76B 'use':58B,147C 'weight':2A,44B,104C,115C 'weight-send':43B 'weightexporter.send':103C 'whole':36B 'without':65B","nicknames":[],"mitigations":[],"who_affected":"Anyone running SGLang 0.5.0 to 0.5.19 whose HTTP server is reachable by people you do not trust. The route is admin-optional, so a server started without --api-key accepts the request from anyone and one request takes the whole server down. The endpoint is registered in the default HTTP server; no special flag is needed. Servers with --api-key set, or on a private network, can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T06:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112083","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112083","severity":null,"published_at":"2026-10-19T06:17:23+00:00","modified_at":"2026-10-19T17:17:11+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112083:810","url":null,"severity":null,"published_at":"2026-10-25T04:13:59+00:00","modified_at":"2026-10-25T04:13:59+00:00","first_seen_at":"2026-10-25T04:13:59+00:00","fetched_at":"2026-10-25T04:13:59+00:00","note":"Read upstream issue #42073 (maintainer repo) and PR #42093: unauthenticated POST /send_weights_to_remote_instance before group init raises KeyError in scheduler, killing the whole server. Fix PR open, unmerged; no released fix. Not marked verified (B tier, issue not a vendor advisory)."}],"documents":[{"id":3382,"url":"https://github.com/sgl-project/sglang/issues/42073","title":"SGLang #42073: /send_weights_to_remote_instance for uncreated group kills the server","kind":"issue","source":"analyst","text":"Maintainer-side issue (reporter Yunzez): weight_exporter.py:93 subscripts _weights_send_group[group_name], raising KeyError in the scheduler loop; scheduler dies, server gets SIGQUIT. Route is AuthLevel.ADMIN_OPTIONAL, so without --api-key anyone can trigger it. Repro: POST /send_weights_to_remote_instance {master_address, ports}. Tested on v0.5.19. Fix PRs #42093, #42096.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3383,"url":"https://github.com/sgl-project/sglang/pull/42093","title":"SGLang PR #42093: Return an error for uninitialized send groups (open)","kind":"release","source":"analyst","text":"Open as of 2026-10-16, not merged. Uses .get() for the guard so the existing error return runs. Adds CPU unit test. CI states shown failing/unrun.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":3384,"url":"https://vuldb.com/vuln/421762","title":"VulDB VDB-421762","kind":"other","source":"analyst","text":"VulDB: affects SGLang 0.5.0 to 0.5.19, remote, no auth, PoC public, CWE-404, no countermeasure known, fix PR awaits acceptance.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}