SGLang CVE-2026-112269

Exploitation requires SGLang to be deployed with the Mooncake disaggregation backend in prefill/decode (PD) disaggregated mode - the vulnerable path is the Prefill rank's ZMQ PULL socket that accepts decode-registration messages without authentication, size limits, or session validation. The attacker must be network-adjacent (CVSS AV:A) to that socket, so reachability depends on network segmentation around the inference cluster rather than open internet exposure. No user interaction or credentials are needed (PR:N/UI:N) against this configuration. This does NOT affect default single-node, non-disaggregated SGLang deployments or setups not using the Mooncake backend, which substantially narrows the realistic exposed population.

The CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N) describes a low-complexity, unauthenticated attack requiring only network-adjacent access, with impact confined to availability (VA:H; VC:N/VI:N) - consistent with CWE-770 uncontrolled resource allocation leading to memory exhaustion and OOM-kill of the scheduler. The 7.1 score is driven entirely by availability loss; there is no confidentiality or integrity impact, so this is a service-disruption issue, not a code-execution or data-breach one. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals do not indicate widespread opportunistic attack. A key limiting factor not reflected in the raw score: exploitation requires the specific Mooncake disaggregation backend to be enabled AND the attacker to reach the Prefill rank's ZMQ PULL socket, which is a network-adjacent (AV:A) prerequisite rather than full internet-wide reachability. This is a credible availability risk for organizations running SGLang in disaggregated prefill/decode (PD) mode on shared or insufficiently segmented networks, but it is a lower priority than a comparable network-reachable RCE. SSVC-style read: exploitation=none observed, automatable=yes (trivially scriptable registration flood), technical impact=partial-to-total loss of the inference service.

An attacker with access to the network segment hosting an SGLang Prefill rank sends a flood of unauthenticated decode-registration messages to the ZMQ PULL socket, each carrying a unique mooncake_session_id and oversized nested-buffer frames. Because the registrations are neither authenticated nor rate/size-limited, the Prefill process allocates memory per message until it is OOM-killed, taking the inference service offline. No public exploit code is identified at time of analysis, but the attack is simple to script against the documented code paths.