4 matches found
CVE-2026-112270
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handlestagingrsp that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGINGR...
CVE-2026-112270 SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handlestagingrsp that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGINGR...
CVE-2026-112270
Versions of SGLang up to and including 0.5.22 using the Mooncake disaggregation backend are vulnerable to an uncontrolled memory allocation vulnerability within the handle_staging_rsp() function. An unauthenticated network-adjacent attacker can exhaust Prefill memory by first obtaining a rank add...
EUVD-2026-104303
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handlestagingrsp that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGINGR...