Live › vulnerability › CVE-2026-112270
Go to dashboardSGLang through 0.5.22, when using the Mooncake disaggregation backend, fails to limit memory allocation in handle_staging_rsp(). An unauthenticated attacker on the network can send crafted STAGING_RSP messages with huge chunk_idx values, forcing the scheduler to allocate memory until it is OOM-killed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running SGLang with prefill/decode disaggregation using the Mooncake backend, where prefill ranks accept network connections. Deployments that do not use the Mooncake disaggregation backend, or that keep prefill ranks off untrusted networks, are less exposed. The sources do not describe default configurations.
No product ranges from the sources yet.
0.5.22 or earlier, for example with pip show sglang./route endpoint and the prefill rank port are reachable from untrusted networks.0.5.22; the sources do not name the fixed version, so check the NVD entry or the SGLang release notes./route endpoint to trusted hosts only.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGING_RSP messages with huge chunk_idx values under fresh room IDs, causing the scheduler to be OOM-killed.
This page as .md · .json · in your agent: get_signal("CVE-2026-112270")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.