EUVD-2026-104303
GHSA-q322-x26r-gm37
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain network-adjacent access to cluster
-
DeliveryQuery /route for Prefill rank address
-
ExploitSend STAGING_RSP with huge chunk_idx
-
ExecutionScheduler allocates unbounded memory
-
ImpactPrefill node OOM-killed, service down
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target to be running SGLang (≤0.5.22) configured with the Mooncake disaggregation backend in a prefill/decode (PD) disaggregated deployment - this is not the default single-node mode, so standard monolithic SGLang deployments are NOT affected. The attacker must be network-adjacent (AV:A) to reach both the /route endpoint (used to obtain the Prefill rank address) and the scheduler's STAGING_RSP message channel; it is not exploitable from the open internet without that network positioning. No authentication (PR:N per the provided vector) and no user interaction are needed once on the network. The limiting factors - non-default disaggregation backend plus required adjacency to an internal inference fabric - substantially narrow realistic exposure despite the HIGH score. |
| Impact | This is a genuine but bounded availability risk, not a top-tier emergency. The provided CVSS 4.0 vector (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: adjacent (AV:A), low-complexity, unauthenticated (PR:N) with no user interaction, and impact confined to availability (VA:H) with zero confidentiality or integrity impact - matching the CWE-770 uncontrolled-memory-allocation OOM-kill outcome. The 7.1 (HIGH) score is driven entirely by the ease of triggering a denial of service, not by data compromise. Signal cross-check: no EPSS score was provided, the CVE is NOT on CISA KEV, and no public exploit was supplied in the inputs - so there is no evidence of active or widespread exploitation. The AV:A (network-adjacent, not AV:N internet-wide) rating is the single most important de-escalating factor: the attacker must already be on the same network segment as the Prefill/scheduler node, which in a typical disaggregated inference cluster is an internal, trusted fabric. Combined with the requirement that the target run the specific Mooncake disaggregation backend, real-world exposure is narrow. Bottom line: prioritize for anyone running SGLang PD-disaggregation in a multi-tenant or exposed cluster, but it is a HIGH-CVSS availability bug with limited blast radius rather than a critical RCE - treat it as a patch-in-normal-cycle item unless your inference fabric is shared or internet-reachable. |
| Exploit ScenarioDerived | An attacker with access to the inference cluster's internal network queries the /route endpoint to discover a Prefill node's rank address, then floods it with STAGING_RSP messages carrying enormous chunk_idx values under freshly generated room IDs. Because handle_staging_rsp() allocates memory based on the attacker-controlled chunk_idx without bounds checking, the scheduler process rapidly exhausts memory and is OOM-killed, taking the Prefill service offline. No public exploit code was supplied in the inputs, but the attack is low-complexity (AC:L) and requires no authentication (PR:N) or user interaction once the attacker is network-adjacent. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
SGLang 0.5.22 and earlier, when deployed with the Mooncake prefill/decode disaggregation backend, can have its Prefill scheduler memory exhausted by unauthenticated network-adjacent attackers, resulting in the scheduler being OOM-killed and inference service becoming unavailable. The attacker first reads the Prefill rank address from the exposed /route endpoint, then sends STAGING_RSP messages carrying oversized chunk_idx values under fresh room identifiers, so handle_staging_rsp() allocates memory without any bound or validation. Only PD-disaggregated deployments using Mooncake are exposed - default single-node SGLang installations do not exercise the affected path - and there is no public exploit code or CISA KEV entry identified at time of analysis, though the HIGH availability impact (CVSS 7.1, AV:A/PR:N) makes an internal-fabric attacker able to repeatedly restart-cycle the service.
RemediationAI
No vendor-released patch version is confirmed in the available data; track https://github.com/sgl-project/sglang/issues/45014 and the VulnCheck advisory (https://www.vulncheck.com/advisories/sglang-through-0.5.22-memory-exhaustion-via-mooncake-staging-rsp-chunk-idx) for the fixed release and upgrade as soon as one is tagged. Until then, the most effective control is to remove exposure: if prefill/decode disaggregation is not required, run SGLang in standard monolithic single-node mode, which never reaches handle_staging_rsp() and eliminates the attack surface entirely (trade-off: loss of independent Prefill/Decode scaling). If disaggregation is required, place the /route endpoint and the Mooncake staging/STAGING_RSP listener behind network policy or a firewall so only known Decode worker IPs can reach them, since the rank address leak from /route is the reconnaissance step the attack depends on (trade-off: any topology change requires policy updates and dynamic worker autoscaling must be allowlisted). Require mutual authentication or mTLS on the disaggregation fabric where the Mooncake transport supports it, and rate-limit or front-proxy /route. As containment, run the Prefill scheduler under a cgroup memory limit with automatic restart and alert on rapid memory growth so an OOM kill affects only the scheduler process rather than the node (trade-off: enforced restarts drop in-flight requests and can be induced repeatedly by a persistent attacker).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SGLang's disaggregated serving mode splits inference into Prefill and Decode workers that exchange KV-cache transfer metadata over an internal fabric; the Mooncake backend implements this with a staging handshake in python/sglang/srt/disaggregation/common/staging_handler.py (handle_staging_rsp, lines 505-548) and connection logic in mooncake/conn.py (lines 2885-2935). The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): chunk_idx values supplied in an incoming STAGING_RSP message are used to size an in-memory staging allocation for a room ID without validating the index against any maximum chunk count or confirming that the sender legitimately owns the room. Because a fresh room ID can be chosen arbitrarily by the sender, room-identity checks do not provide a barrier, and each message with an enormous chunk_idx drives a correspondingly huge allocation in the Prefill scheduler process. The 4.0 vector AV:A/AC:L/AT:N/PR:N/UI:N with VA:H and no confidentiality or integrity impact matches an availability-only resource-exhaustion primitive reachable from the adjacent network rather than the open internet.
Know when Sglang gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-adjacent internal fabric gives AV:A; no auth or interaction needed on that channel (PR:N/UI:N); impact is availability-only OOM with no data exposure (C:N/I:N/A:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGING_RSP messages with huge chunk_idx values under fresh room IDs, causing the scheduler to be OOM-killed.
Executive ViewAI
SGLang 0.5.22 and earlier running the Mooncake prefill/decode disaggregation backend can have its Prefill scheduler driven into memory exhaustion by an attacker positioned on the internal network fabric, causing the scheduler to be OOM-killed and inference serving to go offline repeatedly. Exposure is confined to PD-disaggregated Mooncake deployments - standard single-node SGLang installations do not exercise the vulnerable path - but with no vendor patch yet available, teams operating that architecture carry an unmitigated availability risk to production AI workloads that leadership should track until mitigations are in place.
No vendor-released patch identified at time of analysis; mitigate by allowlisting and segmenting access to the Prefill rank address and /route endpoint, rate-limiting and alerting on STAGING_RSP messages carrying oversized chunk_idx values, monitoring for and auto-restarting on scheduler OOM-kills, and falling back to single-node or non-Mooncake backends where operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote attackers can crash the SGLang inference server (versions up to and including 0.5.19) by calling
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code b
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe
Remote code execution in SGLang AI inference servers allows unauthenticated attackers to run arbitrary code through the
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the op
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, wh
Unauthenticated remote code execution in SGLang versions through v0.5.20 arises from unsafe pickle deserialization in th
Unauthenticated remote code execution in SGLang 0.5.11 through 0.5.14 occurs when the multimodal generation runtime is l
Exploit-DB