{"id":"CVE-2026-112269","kind":"vulnerability","aliases":["CVE-2026-112269"],"related":[],"title":"SGLang: unauthenticated ZMQ registration floods let attackers crash the scheduler","description":"SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations with unique mooncake_session_id values and large nested-buffer frames to exhaust Prefill memory until the scheduler is OOM-killed.","summary":"SGLang through 0.5.22 with the Mooncake disaggregation backend accepts decode registration messages on the Prefill rank ZMQ PULL socket without authentication. A network-adjacent attacker can send many registrations with unique session IDs and large buffer frames until Prefill memory is exhausted and the scheduler is OOM-killed.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","gpu-clusters","llm-inference","mooncake","self-hosted","sglang"],"not_affected_if":["no-mooncake-disaggregation","socket-not-network-reachable"],"how_to_check":"- Check the installed SGLang version with `pip show sglang` and compare it to the fixed release, which the sources do not name.\n- Check whether the deployment runs disaggregated prefill/decode with the Mooncake backend (look for `mooncake` in the server launch flags or config).\n- Check whether the Prefill ZMQ PULL port is reachable from networks other than the decode nodes, for example with `ss -ltnp` and firewall rules.","fix":"- Upgrade SGLang past `0.5.22` once a fixed release is available; the sources do not name the fixed version.\n- Restrict the Prefill rank's ZMQ port to the decode nodes only with firewall or network policy until patched.\n- Unknown whether a configuration option limits registrations; the sources do not say.","status":"open","published_at":"2026-10-19T14:17:04+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:35:03+00:00","updated_at":"2026-10-25T03:35:03+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T03:35:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SGLang past `0.5.22` once a fixed release is available; the sources do not name the fixed version.\n- Restrict the Prefill rank's ZMQ port to the decode nodes only with firewall or network policy until patched.\n- Unknown whether a configuration option limits registrations; the sources do not say.","reach":"network","title":"SGLang: unauthenticated ZMQ registration floods let attackers crash the scheduler","impact":"medium","summary":"SGLang through 0.5.22 with the Mooncake disaggregation backend accepts decode registration messages on the Prefill rank ZMQ PULL socket without authentication. A network-adjacent attacker can send many registrations with unique session IDs and large buffer frames until Prefill memory is exhausted and the scheduler is OOM-killed.","category":"ai-tooling","nicknames":[],"who_cares":["sglang","mooncake","self-hosted","llm-inference","gpu-clusters"],"confidence":0.7,"needs_auth":"no","worst_case":"Prefill scheduler is OOM-killed, halting inference service availability","analyst_note":"Confirm the fixed SGLang version and whether a config option disables unauthenticated registration; check the NVD entry and the SGLang release notes.","how_to_check":"- Check the installed SGLang version with `pip show sglang` and compare it to the fixed release, which the sources do not name.\n- Check whether the deployment runs disaggregated prefill/decode with the Mooncake backend (look for `mooncake` in the server launch flags or config).\n- Check whether the Prefill ZMQ PULL port is reachable from networks other than the decode nodes, for example with `ss -ltnp` and firewall rules.","needs_analyst":true,"not_affected_if":["no-mooncake-disaggregation","socket-not-network-reachable"],"who_is_affected":"Deployments of SGLang through 0.5.22 that use the Mooncake disaggregation backend, where prefill and decode run as separate ranks and the Prefill ZMQ PULL socket accepts registrations. Single-process SGLang deployments or those not using Mooncake disaggregation are not described as affected. Teams that can keep the Prefill socket off untrusted networks have much less exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000741,"input_tokens":3352,"output_tokens":812,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112269':13A,16A '-2026':12A,15A '0.5.22':33B,83C 'accept':39B,89C 'adjac':55B,107C 'ai':18B 'ai-tool':17B 'allow':101C 'attack':7A,56B,108C 'authent':51B 'backend':38B,88C 'buffer':67B,123C 'cluster':22B 'crash':8A 'cve':11A,14A 'decod':40B,91C 'denial':102C 'disaggreg':37B,87C 'exhaust':73B,126C 'flood':5A 'frame':68B,124C 'gpu':21B 'gpu-clust':20B 'host':29B 'id':64B,117C 'infer':25B 'kill':80B,135C 'larg':66B,120C 'let':6A 'llm':24B 'llm-infer':23B 'mani':59B,111C 'memori':71B,128C 'messag':42B,93C 'mooncak':26B,36B,86C,115C 'nest':122C 'nested-buff':121C 'network':54B,106C 'network-adjac':53B,105C 'oom':79B,134C 'oom-kil':78B,133C 'prefil':45B,70B,96C,127C 'pull':48B,99C 'rank':46B,97C 'registr':4A,41B,60B,92C,112C 'schedul':10A,76B,131C 'self':28B 'self-host':27B 'send':58B,110C 'servic':104C 'session':63B,116C 'sglang':1A,30B,31B,81C 'socket':49B,100C 'tool':19B 'unauthent':2A,90C 'uniqu':62B,114C 'valu':118C 'without':50B 'zmq':3A,47B,98C","nicknames":[],"mitigations":[],"who_affected":"Deployments of SGLang through 0.5.22 that use the Mooncake disaggregation backend, where prefill and decode run as separate ranks and the Prefill ZMQ PULL socket accepts registrations. Single-process SGLang deployments or those not using Mooncake disaggregation are not described as affected. Teams that can keep the Prefill socket off untrusted networks have much less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112269","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112269","severity":null,"published_at":"2026-10-19T14:17:04+00:00","modified_at":"2026-10-19T19:17:27+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}