CVE-2026-112266
HIGH
8,2
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
5,9
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high
Description
AI Translation Available
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates all other clients' requests.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0042
Percentile
0,4th
Updated
Single Data Point
Only one EPSS measurement is available for this CVE. Trend analysis requires multiple data points over time.
187
Partial String Comparison
IncompleteCommon Consequences
Security Scopes Affected:
Integrity
Access Control
Potential Impacts:
Alter Execution Logic
Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
https://github.com/sgl-project/sglang/issues/41474
https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/managers/s…
https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/managers/t…
https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/managers/t…
https://github.com/sgl-project/sglang/issues/41474
https://github.com/sgl-project/sglang/issues/45002
https://www.vulncheck.com/advisories/sglang-through-0.5.22-cross-request-abort-…