{"id":"CVE-2026-112270","kind":"vulnerability","aliases":["CVE-2026-112270"],"related":[],"title":"SGLang: unauthenticated staging messages let attackers exhaust prefill memory","description":"SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGING_RSP messages with huge chunk_idx values under fresh room IDs, causing the scheduler to be OOM-killed.","summary":"SGLang through 0.5.22, when using the Mooncake disaggregation backend, fails to limit memory allocation in handle_staging_rsp(). An unauthenticated attacker on the network can send crafted STAGING_RSP messages with huge chunk_idx values, forcing the scheduler to allocate memory until it is OOM-killed.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","llm-serving","mooncake","python","self-hosted","sglang"],"not_affected_if":["isolated-network","no-mooncake-backend"],"how_to_check":"- Check whether the SGLang version is `0.5.22` or earlier, for example with `pip show sglang`.\n- Check whether the server runs prefill/decode disaggregation with the Mooncake backend enabled in its launch flags or config.\n- Check whether the `/route` endpoint and the prefill rank port are reachable from untrusted networks.","fix":"- Upgrade SGLang to a version later than `0.5.22`; the sources do not name the fixed version, so check the NVD entry or the SGLang release notes.\n- Until patched, restrict network access to the prefill ranks and the `/route` endpoint to trusted hosts only.\n- Or disable the Mooncake disaggregation backend if it is not needed.","status":"open","published_at":"2026-10-19T14:17:04+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:35:00+00:00","updated_at":"2026-10-25T03:35:00+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T03:35:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SGLang to a version later than `0.5.22`; the sources do not name the fixed version, so check the NVD entry or the SGLang release notes.\n- Until patched, restrict network access to the prefill ranks and the `/route` endpoint to trusted hosts only.\n- Or disable the Mooncake disaggregation backend if it is not needed.","reach":"network","title":"SGLang: unauthenticated staging messages let attackers exhaust prefill memory","impact":"medium","summary":"SGLang through 0.5.22, when using the Mooncake disaggregation backend, fails to limit memory allocation in handle_staging_rsp(). An unauthenticated attacker on the network can send crafted STAGING_RSP messages with huge chunk_idx values, forcing the scheduler to allocate memory until it is OOM-killed.","category":"ai-tooling","nicknames":[],"who_cares":["sglang","python","self-hosted","llm-serving","mooncake"],"confidence":0.8,"needs_auth":"no","worst_case":"Scheduler is OOM-killed, taking prefill serving offline","analyst_note":"Find the fixed SGLang version and any patch commit from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-112270) or the SGLang repository.","how_to_check":"- Check whether the SGLang version is `0.5.22` or earlier, for example with `pip show sglang`.\n- Check whether the server runs prefill/decode disaggregation with the Mooncake backend enabled in its launch flags or config.\n- Check whether the `/route` endpoint and the prefill rank port are reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["no-mooncake-backend","isolated-network"],"who_is_affected":"Teams running SGLang with prefill/decode disaggregation using the Mooncake backend, where prefill ranks accept network connections. Deployments that do not use the Mooncake disaggregation backend, or that keep prefill ranks off untrusted networks, are less exposed. The sources do not describe default configurations.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000718,"input_tokens":3372,"output_tokens":761,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112270':12A,15A '-2026':11A,14A '/route':111C '0.5.22':30B,77C 'address':108C 'adjac':98C 'ai':17B 'ai-tool':16B 'alloc':41B,67B,87C 'attack':6A,48B,99C,103C 'backend':36B,82C 'caus':127C 'chunk':60B,120C 'contain':83C 'craft':54B 'cve':10A,13A 'disaggreg':35B,81C 'endpoint':112C 'exhaust':7A,100C 'fail':37B 'forc':63B 'fresh':124C 'handl':43B,90C 'host':26B 'huge':59B,119C 'id':126C 'idx':61B,121C 'kill':74B,134C 'let':5A,94C 'limit':39B 'llm':20B 'llm-serv':19B 'memori':9A,40B,68B,86C,102C 'messag':4A,57B,117C 'mooncak':22B,34B,80C 'network':51B,97C 'network-adjac':96C 'obtain':105C 'oom':73B,133C 'oom-kil':72B,132C 'prefil':8A,101C 'python':23B 'rank':107C 'room':125C 'rsp':45B,56B,92C,116C 'schedul':65B,129C 'self':25B 'self-host':24B 'send':53B,114C 'serv':21B 'sglang':1A,27B,28B,75C 'stage':3A,44B,55B,91C,115C 'tool':18B 'unauthent':2A,47B,95C 'uncontrol':85C 'use':32B 'valu':62B,122C 'vulner':88C","nicknames":[],"mitigations":[],"who_affected":"Teams running SGLang with prefill/decode disaggregation using the Mooncake backend, where prefill ranks accept network connections. Deployments that do not use the Mooncake disaggregation backend, or that keep prefill ranks off untrusted networks, are less exposed. The sources do not describe default configurations.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112270","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112270","severity":null,"published_at":"2026-10-19T14:17:04+00:00","modified_at":"2026-10-19T17:17:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}