Unbounded Memory Allocation in SGLang Products by SGL Project

CVE-2026-93838

What is CVE-2026-93838?

SGLang versions up to 0.5.20 are susceptible to an unbounded memory allocation vulnerability. This issue arises in the handle_staging_req() function, where the chunk_idx from ZMQ STAGING_REQ frames is not adequately validated. Attackers capable of accessing the internal ZMQ rank port of the decode engine can exploit this flaw by sending frames with oversized chunk_idx values, leading to excessive memory allocation. This process can ultimately deplete system memory, resulting in termination of the affected processes and potential disruption of service.

References