10 matches found
SUSE CVE-2026-112270
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handlestagingrsp that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGINGR...
CVE-2026-112270
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handlestagingrsp that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGINGR...
CVE-2026-112270
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handlestagingrsp that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGINGR...
EUVD-2026-104303
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handlestagingrsp that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGINGR...
CVE-2026-112270 SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handlestagingrsp that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGINGR...
CVE-2026-112270 SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handlestagingrsp that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGINGR...
CVE-2026-112270
Versions of SGLang up to and including 0.5.22 using the Mooncake disaggregation backend are vulnerable to an uncontrolled memory allocation vulnerability within the handle_staging_rsp() function. An unauthenticated network-adjacent attacker can exhaust Prefill memory by first obtaining a rank add...
CVE-2026-112270 SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handlestagingrsp that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGINGR...
CVE-2026-112270: Allocation of Resources Without Limits or Throttling
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handlestagingrsp that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGINGR...
sgl-project SGLang Resource Management Error Vulnerability
The SGLang version 0.5.22 and earlier have a resource management vulnerability. This vulnerability stems from an uncontrolled memory allocation issue in the handlestagingrsp function. Unauthenticated network attacks allow attackers to obtain the rank address and send STAGINGRSP messages with...