Denial of Service Vulnerability in SGLang by SGL Project

CVE-2026-102634

What is CVE-2026-102634?

SGLang prior to version 0.5.20 contains a vulnerability in its prefill/decode disaggregation mode, where it fails to validate duplicate 'bootstrap_room' fields in requests using the Mooncake KV transfer backend. This flaw allows unauthenticated attackers to exploit the system by sending concurrent requests with identical 'bootstrap_room' values, potentially crashing scheduler processes or causing user requests to hang until a transfer timeout occurs. Proper validation mechanisms are crucial to prevent such exploitation.

References