Uncontrolled Memory Allocation in SGLang's Mooncake Disaggregation Backend

CVE-2026-112270

What is CVE-2026-112270?

The vulnerability in SGLang's Mooncake disaggregation backend through version 0.5.22 allows unauthenticated attackers to exploit an uncontrolled memory allocation in the handle_staging_rsp() function. This can lead to memory exhaustion as attackers can manipulate STAGING_RSP messages with excessive chunk_idx values, targeting fresh room IDs. The exploitation of this vulnerability can cause the scheduler to experience out-of-memory (OOM) errors, potentially interrupting service functionality and availability.

References