CVE-2026-112082: high-severity vulnerability in sgl-project SGLang
sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service
Published
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.7epss 0.6%
exploitation probability
0.6%top 51% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
sgl-project · SGLangpublic PoCs found — 1
cve_referencegithub.com/sgl-project/sglang/issues/42071unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — sgl-project SGLang
In the same product, most dangerous first.
CVE-2026-7669MEDIUMsgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injectionEPSS 0.4%CVE-2026-112083MEDIUMsgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of serviceEPSS 0.4%CVE-2026-110807MEDIUMsgl-project SGLang generate Endpoint io_struct.py denial of serviceEPSS 0.3%CVE-2026-110809MEDIUMsgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of serviceEPSS 0.3%CVE-2026-10775LOWsgl-project SGLang Cache data_hash denial of serviceEPSS 0.1%