Live › vulnerability › CVE-2026-112267
Go to dashboardSGLang through 0.5.22, in prefill/decode disaggregation mode, trusts client-supplied bootstrap_host and bootstrap_port fields on the Decode worker's /generate endpoint, so it makes outbound requests to addresses the caller chooses. An unauthenticated attacker can use this to probe internal hosts and ports and to block the shared scheduler loop, delaying other inference requests.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running SGLang with prefill/decode disaggregation mode, where the Decode worker's /generate endpoint accepts requests from clients that can reach it. Deployments that run a single-node SGLang server without disaggregation, or keep the Decode worker behind a private network with no untrusted callers, have less exposure. The sources do not say whether the flaw is reachable through any other path.
No product ranges from the sources yet.
python -c "import sglang; print(sglang.__version__)"; versions through 0.5.22 are in scope.0.5.22 (the sources do not name the fixed version: unknown).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstrap_host and bootstrap_port fields. Attackers sending crafted requests to the Decode worker's /generate endpoint can probe internal hosts and ports and block the shared scheduler loop, delaying other inference requests.
This page as .md · .json · in your agent: get_signal("CVE-2026-112267")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.