CVE-2026-110807: medium-severity vulnerability in sgl-project SGLang
sgl-project SGLang generate Endpoint io_struct.py denial of service
Published · Updated
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.3%
exploitation probability
0.3%top 75% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file python/sglang/srt/managers/io_struct.py of the component generate Endpoint. This manipulation of the argument session_params causes denial of service. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
sgl-project · SGLangpublic PoCs found — 1
cve_referencegist.github.com/Yunzez/28820d220c52de4810fd5fb2d1dcf409#file-repro_sglang_session_params_crash-pyunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — sgl-project SGLang
In the same product, most dangerous first.
CVE-2026-112082HIGHsgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of serviceEPSS 0.6%CVE-2026-7669MEDIUMsgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injectionEPSS 0.4%CVE-2026-112083MEDIUMsgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of serviceEPSS 0.4%CVE-2026-110809MEDIUMsgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of serviceEPSS 0.3%CVE-2026-10775LOWsgl-project SGLang Cache data_hash denial of serviceEPSS 0.1%
References
https://gist.github.com/Yunzez/28820d220c52de4810fd5fb2d1dcf409#file-repro_sglang_session_params_crash-pyhttps://github.com/sgl-project/sglang/https://github.com/sgl-project/sglang/issues/41467https://github.com/sgl-project/sglang/pull/41535https://vuldb.com/cve/CVE-2026-110807https://vuldb.com/submit/1004351https://vuldb.com/vuln/420278https://vuldb.com/vuln/420278/cti