SUSE CVE-2026-102634

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstraproom fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstraproom values to crash scheduler processes or hang oth...

CVE-2026-102634

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstraproom fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstraproom values to crash scheduler processes or hang oth...

CVE-2026-102634 SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstraproom fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstraproom values to crash scheduler processes or hang oth...

CVE-2026-102634 SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstraproom fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstraproom values to crash scheduler processes or hang oth...

EUVD-2026-89029

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstraproom fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstraproom values to crash scheduler processes or hang oth...

CVE-2026-102634 SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstraproom fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstraproom values to crash scheduler processes or hang oth...

CVE-2026-102634

SGLang versions through 0.5.20 are vulnerable to a Denial of Service (DoS) when running in prefill/decode disaggregation mode with the Mooncake KV transfer backend . The root cause is a failure to validate duplicate bootstrap_room fields in /generate requests. An unauthenticated attacker can expl...

CVE-2026-102634: Use of Multiple Resources with Duplicate Identifier

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstraproom fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstraproom values to crash scheduler processes or hang oth...

CVE-2026-93688

SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstraproom values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine's POST /generate endpoint and submit arbitrary bootstraproom...

CVE-2026-93688 SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room

SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstraproom values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine's POST /generate endpoint and submit arbitrary bootstraproom...

EUVD-2026-82984

SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstraproom values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine's POST /generate endpoint and submit arbitrary bootstraproom...

CVE-2026-93688

SGLang through 0.5.19 is affected by an unbounded memory allocation vulnerability in its prefill/decode disaggregation mode using the Mooncake KV transfer backend . The root cause is a failure to validate bootstrap_room values, which allows an unauthenticated attacker to submit arbitrary values v...

CVE-2026-93688 SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room

SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstraproom values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine's POST /generate endpoint and submit arbitrary bootstraproom...

CVE-2026-93688 SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room

SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstraproom values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine's POST /generate endpoint and submit arbitrary bootstraproom...