CVE-2026-112270

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-112270

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112270.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-112270

Published

2026-10-19T13:55:18Z

Modified

2026-10-24T02:50:10Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx

Details

SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGING_RSP messages with huge chunk_idx values under fresh room IDs, causing the scheduler to be OOM-killed.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-770"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112270.json"
}

References

Affected packages

Git / github.com/sgl-project/sglang

Affected ranges

Type

GIT

Repo

https://github.com/sgl-project/sglang

Events

Introduced

Last Affected

baa9befa381511cd4d56f83980951e5a45fffc6d

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "0.5.22"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "0.5.22"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

gateway-v0.*

gateway-v0.1.5

gateway-v0.1.6

gateway-v0.1.7

gateway-v0.1.8

gateway-v0.1.9

gateway-v0.2.0

gateway-v0.2.1

gateway-v0.2.2

gateway-v0.2.3

gateway-v0.2.4

gateway-v0.3.0

gateway-v0.3.1

v0.*

v0.1.10

v0.1.11

v0.1.12

v0.1.13

v0.1.14

v0.1.15

v0.1.16

v0.1.17

v0.1.18

v0.1.19

v0.1.20

v0.1.21

v0.1.22

v0.1.23

v0.1.24

v0.1.3

v0.1.5

v0.1.6

v0.1.7

v0.1.8

v0.1.9

v0.2.0

v0.2.10

v0.2.11

v0.2.12

v0.2.13

v0.2.14

v0.2.14.post1

v0.2.14.post2

v0.2.15

v0.2.5

v0.2.6

v0.2.7

v0.2.8

v0.2.9

v0.2.9.post1

v0.3.0

v0.3.1.post1

v0.3.1.post2

v0.3.1.post3

v0.3.2

v0.3.3

v0.3.3.post1

v0.3.4

v0.3.4.post1

v0.3.4.post2

v0.3.5

v0.3.5.post1

v0.3.5.post2

v0.3.6

v0.3.6.post1

v0.3.6.post2

v0.3.6.post3

v0.4.0

v0.4.0.post1

v0.4.0.post2

v0.4.1

v0.4.1.post1

v0.4.1.post2

v0.4.1.post3

v0.4.1.post4

v0.4.1.post5

v0.4.1.post6

v0.4.1.post7

v0.4.10

v0.4.10.post1

v0.4.10.post2

v0.4.2

v0.4.2.post1

v0.4.2.post2

v0.4.2.post3

v0.4.2.post4

v0.4.3

v0.4.3.post1

v0.4.3.post2

v0.4.3.post3

v0.4.3.post4

v0.4.4

v0.4.4.post1

v0.4.4.post2

v0.4.4.post3

v0.4.4.post4

v0.4.5

v0.4.5.post1

v0.4.5.post2

v0.4.5.post3

v0.4.6

v0.4.6.post1

v0.4.6.post2

v0.4.6.post3

v0.4.6.post4

v0.4.6.post5

v0.4.7

v0.4.7.post1

v0.4.8

v0.4.8.post1

v0.4.9

v0.4.9.post1

v0.4.9.post2

v0.4.9.post3

v0.4.9.post4

v0.4.9.post5

v0.4.9.post6

v0.5.0rc0

v0.5.0rc1

v0.5.0rc2

v0.5.1

v0.5.1.post1

v0.5.1.post2

v0.5.1.post3

v0.5.2

v0.5.22

v0.5.2rc0

v0.5.2rc1

v0.5.2rc2

v0.5.3

v0.5.3.post1

v0.5.3.post2

v0.5.3.post3

v0.5.3rc0

v0.5.3rc1

v0.5.3rc2

v0.5.4

v0.5.4.post1

v0.5.4.post2

v0.5.4.post3

v0.5.5

v0.5.5.post1

v0.5.5.post2

v0.5.5.post3

v0.5.6

v0.5.6.post1

v0.5.6.post2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112270.json"