CVE-2026-102634

SGLang versions through 0.5.20 are vulnerable to a Denial of Service (DoS) when running in prefill/decode disaggregation mode with the Mooncake KV transfer backend . The root cause is a failure to validate duplicate bootstrap_room fields in /generate requests. An unauthenticated attacker can expl...

CVE-2026-92972: Missing Authentication for Critical Function

SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rankip and rankport values to redirect decode workers to...