Denial of Service in SGLang Affects API Users by Allowing Abort of Requests

CVE-2026-112266

What is CVE-2026-112266?

SGLang versions up to 0.5.22 are vulnerable to a denial of service issue that allows malicious API clients to disrupt ongoing request processes. By submitting requests with short, controlled 'rid' identifiers, an attacker can utilize prefix-matching logic to abort other users' in-flight generation requests. This vulnerability can be exploited by connecting and disconnecting quickly, leading to service interruptions for all clients making requests simultaneously. It highlights the need for robust security measures in handling request identifiers to prevent unintended request terminations.

References