SGLang CVE-2026-112266

Requires network reachability to SGLang's streaming /generate API (through version 0.5.22) and the ability to supply a short, client-controlled rid (e.g., a single hex character). Critically, impact is only realized when OTHER users' generation requests are concurrently in flight - the attacker aborts them via prefix-matching when disconnecting, so a single-tenant or idle server yields no victim impact (this is the basis for the vendor's AC:H/AT:P rating). No authentication is required (PR:N) and no user interaction is needed; the main limiting factors are the need for concurrent victim traffic and exposure of the /generate endpoint to the attacker (multi-tenant or internet-facing deployments are most at risk).

This is a genuine availability-focused issue but sits below the 'drop-everything' tier despite its 8.2 CVSS 4.0 score. The vendor vector (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: network-reachable (AV:N), no authentication (PR:N), no user interaction (UI:N), and high availability impact (VA:H) with zero confidentiality/integrity impact - consistent with a pure DoS and the CWE-187 (partial/incorrect string comparison) root cause in the rid prefix-matching abort logic. The AC:H and AT:P metrics are the key risk dampeners: successful impact requires other users' requests to actually be in flight at the moment of the attack, so the attacker depends on conditions outside their control. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis - exploitation status is purely theoretical/vendor-reported (VulnCheck). Net: a real, low-effort-to-trigger availability bug worth patching on internet- or multi-tenant-exposed SGLang deployments, but not evidence of active, widespread exploitation. Note the absence of EPSS/KEV/POC is not itself a contradiction - it simply means no exploitation-probability signal is available to corroborate the high CVSS.

An attacker with network access to a multi-tenant SGLang inference server submits streaming requests to the /generate endpoint using a single hex-character client-controlled rid, then disconnects. The disconnect triggers abort logic that prefix-matches the short rid against all active request IDs, terminating other legitimate users' in-flight generations and denying them service. No public exploit code is identified in the provided data, but the technique is fully described in the VulnCheck advisory.