CVE-2026-112083

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-112083

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112083.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-112083

Published

2026-10-19T05:45:18Z

Modified

2026-10-20T02:45:47Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service

Details

A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send_weights_to_remote_instance of the file python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of the component Weight Exporter. Performing a manipulation of the argument group_name results in denial of service. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-404"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112083.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "0.5.0"
                },
                {
                    "last_affected":  "0.5.0"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/sgl-project/sglang

Affected ranges

Type

GIT

Repo

https://github.com/sgl-project/sglang

Events

Introduced

97a38ee85ba62e268bde6388f1bf8edfe2ca9d76

Last Affected

0bcd822377da7b5718e674eaf9c870d349424dd1

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0.5.1"
        },
        {
            "last_affected":  "0.5.1"
        },
        {
            "introduced":  "0.5.2"
        },
        {
            "last_affected":  "0.5.2"
        },
        {
            "introduced":  "0.5.3"
        },
        {
            "last_affected":  "0.5.3"
        },
        {
            "introduced":  "0.5.4"
        },
        {
            "last_affected":  "0.5.4"
        },
        {
            "introduced":  "0.5.5"
        },
        {
            "last_affected":  "0.5.5"
        },
        {
            "introduced":  "0.5.6"
        },
        {
            "last_affected":  "0.5.6"
        },
        {
            "introduced":  "0.5.7"
        },
        {
            "last_affected":  "0.5.7"
        },
        {
            "introduced":  "0.5.8"
        },
        {
            "last_affected":  "0.5.8"
        },
        {
            "introduced":  "0.5.9"
        },
        {
            "last_affected":  "0.5.9"
        },
        {
            "introduced":  "0.5.10"
        },
        {
            "last_affected":  "0.5.10"
        },
        {
            "introduced":  "0.5.11"
        },
        {
            "last_affected":  "0.5.11"
        },
        {
            "introduced":  "0.5.12"
        },
        {
            "last_affected":  "0.5.12"
        },
        {
            "introduced":  "0.5.13"
        },
        {
            "last_affected":  "0.5.13"
        },
        {
            "introduced":  "0.5.14"
        },
        {
            "last_affected":  "0.5.14"
        },
        {
            "introduced":  "0.5.15"
        },
        {
            "last_affected":  "0.5.15"
        },
        {
            "introduced":  "0.5.16"
        },
        {
            "last_affected":  "0.5.16"
        },
        {
            "introduced":  "0.5.17"
        },
        {
            "last_affected":  "0.5.17"
        },
        {
            "introduced":  "0.5.18"
        },
        {
            "last_affected":  "0.5.18"
        },
        {
            "introduced":  "0.5.19"
        },
        {
            "last_affected":  "0.5.19"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*

0.5.1

0.5.10

0.5.11

0.5.12

0.5.13

0.5.14

0.5.15

0.5.16

0.5.17

0.5.18

0.5.19

0.5.2

0.5.3

0.5.4

0.5.5

0.5.6

0.5.7

0.5.8

0.5.9

gateway-v0.*

gateway-v0.2.0

gateway-v0.2.1

gateway-v0.2.2

gateway-v0.2.3

gateway-v0.2.4

gateway-v0.3.0

gateway-v0.3.1

v0.*

v0.5.1

v0.5.1.post1

v0.5.1.post2

v0.5.1.post3

v0.5.19

v0.5.2

v0.5.2rc0

v0.5.2rc1

v0.5.2rc2

v0.5.3

v0.5.3.post1

v0.5.3.post2

v0.5.3.post3

v0.5.3rc0

v0.5.3rc1

v0.5.3rc2

v0.5.4

v0.5.4.post1

v0.5.4.post2

v0.5.4.post3

v0.5.5

v0.5.5.post1

v0.5.5.post2

v0.5.5.post3

v0.5.6

v0.5.6.post1

v0.5.6.post2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112083.json"