4 matches found
CVE-2026-112266
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering...
CVE-2026-112266
SGLang versions through 0.5.22 are vulnerable to a denial of service flaw caused by incorrect rid prefix matching logic. An API client can trigger a cross-request abort by submitting a streaming /generate request with a short, client-controlled rid (e.g., a single hex character) and then disconne...
CVE-2026-112266 SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering...
EUVD-2026-104307
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering...