CVE-2026-110807mediumCWE-404

CVE-2026-110807: falha de média gravidade em sgl-project SGLang

sgl-project SGLang generate Endpoint io_struct.py denial of service

Publicada em · Atualizada em

33Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 5.3epss 0.3%
probabilidade de exploração
0.3%top 75% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file python/sglang/srt/managers/io_struct.py of the component generate Endpoint. This manipulation of the argument session_params causes denial of service. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
sgl-project · SGLang
PoCs públicas encontradas — 1
cve_referencegist.github.com/Yunzez/28820d220c52de4810fd5fb2d1dcf409#file-repro_sglang_session_params_crash-pynão verificado
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — sgl-project SGLang

No mesmo produto, das mais perigosas para as menos.

CVE-2026-7669MEDIUMsgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injectionEPSS 0.4%CVE-2026-110809MEDIUMsgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of serviceEPSS 0.3%CVE-2026-10775LOWsgl-project SGLang Cache data_hash denial of serviceEPSS 0.1%CVE-2026-112082HIGHsgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of serviceEPSS —
Referências
https://gist.github.com/Yunzez/28820d220c52de4810fd5fb2d1dcf409#file-repro_sglang_session_params_crash-pyhttps://github.com/sgl-project/sglang/https://github.com/sgl-project/sglang/issues/41467https://github.com/sgl-project/sglang/pull/41535https://vuldb.com/cve/CVE-2026-110807https://vuldb.com/submit/1004351https://vuldb.com/vuln/420278https://vuldb.com/vuln/420278/cti