Memory Exhaustion Vulnerability in SGLang Software by SGL Project

CVE-2026-112269

What is CVE-2026-112269?

The SGLang software, specifically versions up to 0.5.22, exhibits a memory exhaustion vulnerability due to its Mooncake disaggregation backend. This issue allows attackers who are on the same network to send unauthenticated decode registration messages through the Prefill rank ZMQ PULL socket. By doing so, they can flood the system with numerous registration requests, each with distinct mooncake_session_id values and large nested-buffer frames. If exploited, this can lead to the Prefill memory being completely consumed, causing the scheduler to be terminated due to out-of-memory (OOM) conditions. It's essential for users of SGLang to be aware of this vulnerability and implement appropriate measures to mitigate potential attacks.

References