---
id: "CVE-2026-112083"
kind: "vulnerability"
aliases: ["CVE-2026-112083"]
title: "SGLang: weight exporter group_name argument allows remote denial of service"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "sglang", "fixed": [], "affected": ">= 0.5.0, <= 0.5.19", "ecosystem": "pypi"}]
ecosystems: []
tags: ["ai-tooling", "llm-serving", "python", "self-hosted", "sglang"]
not_affected_if: ["api-key-set", "auth-required", "private-network-only"]
published_at: "2026-10-19T06:17:23+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:13:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112083", "first_seen_at": "2026-10-23T21:57:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T04:13:59+00:00"}]
---

# SGLang: weight exporter group_name argument allows remote denial of service

SGLang's /send_weights_to_remote_instance endpoint crashes the whole server with one request if no weight-send group was initialised first. The code subscripts a dict (KeyError) instead of using .get(), so the scheduler process dies. Without --api-key anyone who can reach the port can trigger it. A PoC is public; no exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:sglang affected >= 0.5.0, <= 0.5.19 fixed ?

## How to check

- pip show sglang: versions 0.5.0 to 0.5.19 are listed as affected (0.5.20+ unconfirmed, check whether the fix PR is in your build)
- In your install, check weight_exporter.py: if it has self._weights_send_group[group_name] is not None (around line 93) rather than .get(), it is vulnerable
- Check whether the server was launched without --api-key and whether its port is reachable from untrusted networks

## Fix

No released fix as of 2026-10-25. Upstream PR sgl-project/sglang#42093 (also #42096) is open and unmerged; it changes the guard to .get() so the request returns a 400. Until a release includes it: start the server with --api-key, keep the API port off untrusted networks, and block POST /send_weights_to_remote_instance at the proxy if you do not use remote weight transfer.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112083
- 2026-10-25T04:13:59+00:00 analyst — Read upstream issue #42073 (maintainer repo) and PR #42093: unauthenticated POST /send_weights_to_remote_instance before group init raises KeyError in scheduler, killing the whole server. Fix PR open, unmerged; no released fix. Not marked verified (B tier, issue not a vendor advisory).

## Documents

- [advisory] SGLang #42073: /send_weights_to_remote_instance for uncreated group kills the server https://github.com/sgl-project/sglang/issues/42073
- [fix] SGLang PR #42093: Return an error for uninitialized send groups (open) https://github.com/sgl-project/sglang/pull/42093
- [mentions] VulDB VDB-421762 https://vuldb.com/vuln/421762

## From the sources

A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send_weights_to_remote_instance of the file python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of the component Weight Exporter. Performing a manipulation of the argument group_name results in denial of service. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_