CVE-2026-102634: high-severity vulnerability in sgl-project sglang
SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room
Published
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.6%
exploitation probability
0.6%top 54% of all CVEs
observed exploitation
nono source reports it
SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstrap_room values to crash scheduler processes or hang other users' requests until transfer timeout.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
sgl-project · sglangRelated CVEs — sgl-project sglang
In the same product, most dangerous first.
CVE-2026-93688HIGHSGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_roomEPSS 0.7%CVE-2026-93838HIGHSGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idxEPSS 0.7%CVE-2026-92972HIGHSGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpointEPSS 0.5%CVE-2026-105245MEDIUMsgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmissionEPSS 0.2%
References
https://github.com/sgl-project/sglanghttps://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/common/conn.py#L392-L393https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/decode.py#L942https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/mooncake/conn.py#L2760-L2764https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/managers/io_struct.py#L281https://github.com/sgl-project/sglang/issues/40125https://www.vulncheck.com/advisories/sglang-through-0.5.20-denial-of-service-via-duplicate-bootstrap-room