EUVD-2026-104079
GHSA-j823-x22q-54wf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed SGLang HTTP control API
-
ExploitSend request to expert-distribution record endpoint
-
ExecutionTrigger unhandled ValueError (recorder mode disabled)
-
ImpactDenial of service on inference server
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | Exploitation requires network reachability to the SGLang HTTP server's expert-distribution control endpoints (start_expert_distribution_record / stop_expert_distribution_record / dump_expert_distribution_record). The crash is triggered specifically when these endpoints are invoked while the server was NOT started with --expert-distribution-recorder-mode (i.e. recorder mode is None), which is the default state - so default configurations are affected rather than a special opt-in setup. No authentication is indicated (PR:N) and no user interaction is needed (UI:N). The primary LIMITING factor is exposure: SGLang control APIs are commonly bound to internal or trusted networks, so real-world reachability of the endpoint by an untrusted attacker is the gating prerequisite rather than any product configuration. |
| Impact | The input CVSS 4.0 base score is 7.7 (High), driven entirely by availability impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N) and no scope change. The vector indicates remote, low-complexity, unauthenticated exploitation (AV:N/AC:L/AT:N/PR:N/UI:N), and the embedded exploit-maturity metric (E:P) is consistent with the reported publicly available proof-of-concept. CWE-404 (improper resource/shutdown handling) matches the source evidence: calling an expert-distribution control endpoint while recording is not enabled propagated an unhandled ValueError, crashing the request path. Signals are internally consistent - a single crafted request yields denial of service, and the flaw is trivially automatable. However, key prioritization signals are MISSING: no EPSS score is provided, and the CVE is NOT listed in CISA KEV, so there is no evidence of active exploitation - only POC availability, which must not be conflated with in-the-wild use. Real-world risk is moderated by exposure: SGLang HTTP control endpoints are typically bound to internal/trusted networks rather than the public internet, so despite the PR:N vector the practical attack surface depends on deployment. Net assessment: a credible, easy-to-trigger availability bug worth patching for any internet- or multi-tenant-exposed SGLang instance, but not a drop-everything emergency absent KEV/EPSS evidence of mass exploitation. |
| Exploit ScenarioDerived | An attacker with network access to an SGLang server's HTTP API sends a request to one of the expert-distribution control endpoints (e.g. start/stop/dump_expert_distribution_record) on an instance where expert-distribution recording was never enabled. The resulting unhandled ValueError disrupts the request-handling path, denying service to the inference endpoint. A public proof-of-concept exists (referenced GitHub issue #42071), lowering the skill required to reproduce the crash. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 19, 2026
Unauthenticated remote attackers can crash the SGLang inference server (versions up to and including 0.5.19) by calling its expert-distribution recording control endpoints - /start_expert_distribution_record, /stop_expert_distribution_record and /dump_expert_distribution_record - on a server that was launched without --expert-distribution-recorder-mode, which is the default configuration. Because the recorder is never initialized in that state, the request path into Scheduler.expert_distribution_handle fails without a handled error, producing a denial of service against the serving process; confidentiality and integrity are unaffected. Publicly available exploit code exists (a proof-of-concept is linked from the vendor issue tracker), but there is no evidence of confirmed active exploitation (no CISA KEV listing); the practical gate on real-world abuse is whether the SGLang control API is reachable from an untrusted network, since these endpoints are typically bound to internal or trusted segments. Vendor-released patch: not confirmed - the fix is an upstream pull request (sgl-project/sglang#42098) that is still awaiting acceptance.
Earlier versions of this analysis (1)
Denial of service in sgl-project SGLang through 0.5.19 allows remote attackers to disrupt the serving process by invoking the expert-distribution recording control endpoints (start, stop, or dump) without authentication. The flaw is an unhandled ValueError path when the server was started without --expert-distribution-recorder-mode; publicly available exploit code exists, but no CISA KEV entry confirms active exploitation. Impact is limited to availability of the SGLang HTTP service.
RemediationAI
No tagged patched release is confirmed at time of analysis: the fix exists only as upstream pull request https://github.com/sgl-project/sglang/pull/42098, which awaits acceptance, so track that PR and upgrade to the first SGLang release published after 0.5.19 that includes it (verify the ValueError guard in tokenizer_control_mixin._expert_distribution_record before trusting the version string). Until then, the most direct compensating control is to make the control API unreachable: block external access to /start_expert_distribution_record, /stop_expert_distribution_record and /dump_expert_distribution_record at the reverse proxy or network policy layer, or bind the SGLang HTTP server only to loopback/internal interfaces - the trade-off is that legitimate operators lose remote profiling access and must invoke these routes locally or over a trusted tunnel. A secondary workaround is to start the server with --expert-distribution-recorder-mode (stat, stat_approx, per_pass or per_token), which makes the code path take the initialized-recorder branch instead of the failing one; the cost is continuous expert-routing bookkeeping overhead and larger memory footprint, and it only protects against this specific crash path, not other malformed control requests. Where the API must stay exposed, front it with an authenticating proxy to raise the bar beyond the unauthenticated (PR:N) default, though authentication is a defense-in-depth measure and not a substitute for the upstream patch. Monitor the server for repeated 5xx responses or process restarts correlated with expert-distribution route access as a detection signal, and consult https://vuldb.com/vuln/421761 for any updated vendor guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SGLang is a Python-based LLM serving framework whose HTTP entrypoint (python/sglang/srt/entrypoints/http_server.py) exposes FastAPI routes that delegate through the TokenizerManager control mixin to the scheduler. The affected component is the Expert-Distribution Recording feature, used with Mixture-of-Experts models and expert-parallel load balancing (EPLB, python/sglang/srt/eplb/expert_distribution.py), which collects per-expert token routing statistics via an ExpertDistributionReq with START_RECORD, STOP_RECORD or DUMP_RECORD actions. When the server is started without --expert-distribution-recorder-mode, get_exec().moe.expert_distribution_recorder_mode is None and no recorder object exists; the control request is nevertheless dispatched to Scheduler.expert_distribution_handle, where it hits an unhandled failure rather than a clean rejection. The assigned CWE-404 (Improper Resource Shutdown or Release) reflects this misuse of an uninitialized/unreleased recorder resource in the request lifecycle. The upstream fix (PR #42098) refactors start/stop/dump into a shared _expert_distribution_record helper that raises a ValueError with an operator-facing message when recorder mode is None, and wraps the three HTTP handlers in try/except ValueError blocks that return a structured error response via _create_error_response instead of propagating the fault. A regression test (test/registered/unit/entrypoints/test_expert_distribution_control.py) asserts that disabled controls never send scheduler requests and that enabled modes dispatch the correct action.
Know when Sglang gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Unauthenticated, low-complexity request to a network-exposed control endpoint (PR:N/AV:N/AC:L); impact is an unhandled error crashing the service, so availability-only (A:H, C:N/I:N).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
Technical POC Analysis
CWE-404 (Improper Resource Shutdown or Release), per the CVE assignment.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
SGLang inference servers running versions up to and including 0.5.19 contain a high-severity availability flaw that allows a crafted request to crash the serving process, taking model inference offline for dependent applications. Publicly available exploit code exists, so the practical exposure hinges on whether the SGLang control API is reachable from an untrusted network; broadly exposed deployments face near-term disruption risk while internal-only deployments carry lower likelihood. Leadership should prioritize inventorying SGLang instances and confirming a patched version is deployed.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code b
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe
Remote code execution in SGLang AI inference servers allows unauthenticated attackers to run arbitrary code through the
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the op
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, wh
Unauthenticated remote code execution in SGLang versions through v0.5.20 arises from unsafe pickle deserialization in th
Unauthenticated remote code execution in SGLang 0.5.11 through 0.5.14 occurs when the multimodal generation runtime is l
Denial of service in SGLang 0.5.19 and earlier allows an attacker who can reach the remote weight-export path to supply
Exploit-DB