Unbounded Memory Allocation in SGLang by SGL Project

CVE-2026-93688

What is CVE-2026-93688?

The SGLang product from the SGL Project prior to version 0.5.19 has a significant vulnerability that resides in its prefill/decode disaggregation mode, particularly when utilized with the Mooncake KV transfer backend. This flaw occurs due to the lack of validation for 'bootstrap_room' values. As a result, unauthenticated attackers can exploit this weakness by submitting arbitrary values to the decode engine's POST /generate endpoint, ultimately leading to an unbounded memory allocation problem. Such exploitation might exhaust the memory dedicated to the prefill processes of the application, risking downtime through out-of-memory errors.

References