CVE-2026-112083: falha de média gravidade em sgl-project SGLang
sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service
Publicada em
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 6.9epss 0.4%
probabilidade de exploração
0.4%top 65% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send_weights_to_remote_instance of the file python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of the component Weight Exporter. Performing a manipulation of the argument group_name results in denial of service. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
sgl-project · SGLangPoCs públicas encontradas — 1
cve_referencegithub.com/sgl-project/sglang/issues/42073não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — sgl-project SGLang
No mesmo produto, das mais perigosas para as menos.
CVE-2026-112082HIGHsgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of serviceEPSS 0.6%CVE-2026-7669MEDIUMsgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injectionEPSS 0.4%CVE-2026-110807MEDIUMsgl-project SGLang generate Endpoint io_struct.py denial of serviceEPSS 0.3%CVE-2026-110809MEDIUMsgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of serviceEPSS 0.3%CVE-2026-10775LOWsgl-project SGLang Cache data_hash denial of serviceEPSS 0.1%