CVE-2026-112269

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-112269

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112269.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-112269

Published

2026-10-19T13:55:17Z

Modified

2026-10-24T02:48:34Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations

Details

SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations with unique mooncake_session_id values and large nested-buffer frames to exhaust Prefill memory until the scheduler is OOM-killed.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-770"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112269.json"
}

References

Affected packages

Git / github.com/sgl-project/sglang

Affected ranges

Type

GIT

Repo

https://github.com/sgl-project/sglang

Events

Introduced

Last Affected

baa9befa381511cd4d56f83980951e5a45fffc6d

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "0.5.22"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "0.5.22"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

gateway-v0.*

gateway-v0.1.5

gateway-v0.1.6

gateway-v0.1.7

gateway-v0.1.8

gateway-v0.1.9

gateway-v0.2.0

gateway-v0.2.1

gateway-v0.2.2

gateway-v0.2.3

gateway-v0.2.4

gateway-v0.3.0

gateway-v0.3.1

v0.*

v0.1.10

v0.1.11

v0.1.12

v0.1.13

v0.1.14

v0.1.15

v0.1.16

v0.1.17

v0.1.18

v0.1.19

v0.1.20

v0.1.21

v0.1.22

v0.1.23

v0.1.24

v0.1.3

v0.1.5

v0.1.6

v0.1.7

v0.1.8

v0.1.9

v0.2.0

v0.2.10

v0.2.11

v0.2.12

v0.2.13

v0.2.14

v0.2.14.post1

v0.2.14.post2

v0.2.15

v0.2.5

v0.2.6

v0.2.7

v0.2.8

v0.2.9

v0.2.9.post1

v0.3.0

v0.3.1.post1

v0.3.1.post2

v0.3.1.post3

v0.3.2

v0.3.3

v0.3.3.post1

v0.3.4

v0.3.4.post1

v0.3.4.post2

v0.3.5

v0.3.5.post1

v0.3.5.post2

v0.3.6

v0.3.6.post1

v0.3.6.post2

v0.3.6.post3

v0.4.0

v0.4.0.post1

v0.4.0.post2

v0.4.1

v0.4.1.post1

v0.4.1.post2

v0.4.1.post3

v0.4.1.post4

v0.4.1.post5

v0.4.1.post6

v0.4.1.post7

v0.4.10

v0.4.10.post1

v0.4.10.post2

v0.4.2

v0.4.2.post1

v0.4.2.post2

v0.4.2.post3

v0.4.2.post4

v0.4.3

v0.4.3.post1

v0.4.3.post2

v0.4.3.post3

v0.4.3.post4

v0.4.4

v0.4.4.post1

v0.4.4.post2

v0.4.4.post3

v0.4.4.post4

v0.4.5

v0.4.5.post1

v0.4.5.post2

v0.4.5.post3

v0.4.6

v0.4.6.post1

v0.4.6.post2

v0.4.6.post3

v0.4.6.post4

v0.4.6.post5

v0.4.7

v0.4.7.post1

v0.4.8

v0.4.8.post1

v0.4.9

v0.4.9.post1

v0.4.9.post2

v0.4.9.post3

v0.4.9.post4

v0.4.9.post5

v0.4.9.post6

v0.5.0rc0

v0.5.0rc1

v0.5.0rc2

v0.5.1

v0.5.1.post1

v0.5.1.post2

v0.5.1.post3

v0.5.2

v0.5.22

v0.5.2rc0

v0.5.2rc1

v0.5.2rc2

v0.5.3

v0.5.3.post1

v0.5.3.post2

v0.5.3.post3

v0.5.3rc0

v0.5.3rc1

v0.5.3rc2

v0.5.4

v0.5.4.post1

v0.5.4.post2

v0.5.4.post3

v0.5.5

v0.5.5.post1

v0.5.5.post2

v0.5.5.post3

v0.5.6

v0.5.6.post1

v0.5.6.post2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112269.json"