SGLang EUVD-2026-101757

Exploitation requires the ability to send requests to SGLang's 'generate' HTTP endpoint using the session feature, specifically supplying a session_params object in which one of the fields (id, rid, offset, replace, or drop_previous_output) is of an incorrect type - e.g., id or rid as a non-string, offset as a string or bool, or replace/drop_previous_output as a non-bool. In vulnerable versions (≤0.5.19) SessionParams(**obj.session_params) is constructed with no type validation, so the mismatched type raises an uncaught TypeError. Limiting factors: the CVSS assigns PR:L, implying some level of API access/privilege is needed, and no user interaction is required; impact is confined to availability of request handling (no data exposure or code execution). A key real-world caveat: SGLang generate endpoints are often deployed without authentication, which would make the condition trivially reachable (effectively PR:N) despite the vendor's PR:L rating.

This is a low-severity denial-of-service issue, and the available signals are consistent in pointing to limited real-world priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) yields a base score of only 2.1: network-reachable and low-complexity, but requiring some privilege (PR:L), with no confidentiality or integrity impact and only a low availability impact (VA:L). Exploitation status: publicly available exploit code exists (a repro script is published as a GitHub gist and the CVSS carries E:P/Proof-of-Concept), but this is NOT active exploitation - it is not listed in CISA KEV and no EPSS score was supplied, so widespread or automated exploitation is not evidenced. The source-code evidence (PR #41535) confirms the root cause and the limited impact: supplying a wrong-typed session_params field raises an uncaught TypeError during request tokenization, failing the request rather than achieving code execution or persistent server compromise, which is consistent with VA:L rather than a full-service crash. Note a plausible discrepancy worth verifying: the vector asserts PR:L (authenticated), yet SGLang's HTTP generate endpoint is frequently deployed without authentication, in which case real-world exploitation could be effectively unauthenticated (PR:N) - defenders should verify whether their deployment exposes the endpoint openly. Bottom line: genuine but low-priority; patch in routine cycles, prioritize only if an SGLang generate endpoint is internet-exposed without auth.

An attacker with access to the SGLang generate endpoint sends a crafted request whose session_params object contains a field of the wrong type (for example, 'id' as a list or 'offset' as a string). SGLang constructs the SessionParams struct without type checking, raising an uncaught TypeError that aborts request processing and denies service. A public proof-of-concept repro script demonstrating the crash is available.