EUVD-2026-101799
GHSA-cq8f-cv6m-8vvq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to SGLang session API
-
DeliveryOpen session and seed request nodes
-
ExploitSend generate with replace=true and no rid
-
ExecutionTrigger dict-mutation-during-iteration in cleanup
-
ImpactCrash request handling (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | Requires an actor who can reach and authenticate to the SGLang API session endpoints (open_session and generate), consistent with PR:L - this is not an anonymous internet attack. The specific trigger is a generation request carrying session_params.replace=true with rid=None against a session that already contains request nodes, which drives the buggy cleanup loop in Session.create_req (session_controller.py). Limiting factors: the deployment must expose the session-control feature and accept session_params; the impact is confined to crashing request/session handling (VA:L), not persistent or whole-node compromise; no code execution or data exposure is possible. |
| Impact | This is a genuinely low-priority issue despite being remotely reachable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the vendor base score of 2.1 agree that impact is minimal: confidentiality and integrity are untouched (VC:N/VI:N) and only availability is affected at a low level (VA:L), with no scope change to other systems. The flaw (CWE-404, improper resource release during session cleanup) causes a crash in session-request handling, not a full-server outage. Exploitation requires low-level privileges (PR:L), i.e. an actor who can already authenticate to the SGLang API, which materially narrows the threat population. A public proof-of-concept exists (the gist repro script and the attached regression tests), reflected in the CVSS temporal metric E:P (Proof-of-Concept), but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of real-world active exploitation. Signals are consistent rather than conflicting: a reachable-but-low-impact DoS requiring authentication, with POC available but no observed in-the-wild use. Note the vuldb-sourced wording 'may be used' indicates disclosure, not confirmed exploitation. |
| Exploit ScenarioDerived | An authenticated client with access to the SGLang inference API opens a session, issues a few generation requests to build a request-node tree, then submits a generate call with session_params.replace=true and no rid. The cleanup path in Session.create_req iterates self.req_nodes while req_node.clear() mutates that same dict, raising a RuntimeError that crashes the request. A public PoC (repro_sglang_session_replace_crash.py) demonstrates the condition. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
SGLang up to and including 0.5.19 can be crashed through its session-control API: an authenticated client that issues a generation request with session_params.replace=true and rid=None against a session that already holds request nodes triggers the cleanup loop in Session.create_req, which mutates the request-node dictionary while iterating it and raises an unhandled exception. The impact is confined to availability of the affected request/session handling (CVSS 2.1 / assessed CVSS:3.1 A:L) - there is no code execution, privilege escalation, or data exposure - but the flaw is remotely reachable and publicly available exploit code exists, meaning reachable and authenticated SGLang deployments are at risk of request-path crashes. The upstream fix sits in an unmerged pull request, so no released patched version is confirmed and operators must rely on exposure reduction until the fix lands.
RemediationAI
The upstream fix is the change in pull request https://github.com/sgl-project/sglang/pull/41483, which snapshots the request-node values and clears only parentless (root) nodes; however, that PR is still awaiting acceptance, so the status is best described as upstream fix available (PR/commit) with no released patched version independently confirmed - do not assume a tagged SGLang release containing the fix until the PR is merged and a version is published. Until then, the most effective compensating control is exposure reduction: because the trigger requires the ability to call /open_session and /generate with session_params (CVSS PR:L), place the SGLang server behind an authenticating reverse proxy or API gateway and restrict those endpoints to trusted internal clients only - the trade-off is that this does not prevent an authorized but untrusted client (or a compromised tenant) from still causing the crash. If multi-turn session control is not required, disable the session-control feature or block the session endpoints entirely at the proxy layer, accepting the loss of session/branching functionality. Where sessions must stay enabled, add request validation in front of the server that rejects or strips session_params combinations of replace=true with rid=None against sessions that already contain request nodes, and apply per-client rate limiting so repeated crash attempts cannot be trivially looped; both measures add latency and maintenance overhead and are bypassable if the client can reach the backend directly, so network segmentation of the inference service is strongly recommended alongside them. Monitor upstream issue #41470 and the VULDB entry for the merged-fix announcement and re-deploy once an official patched release is available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SGLang is an open-source LLM serving framework whose session controller (python/sglang/srt/session/session_controller.py) maintains a tree of SessionReqNode objects in the self.req_nodes dictionary, keyed by request ID, with parent/child links that model forked or branched generation requests within a session. CWE-404 (Improper Resource Shutdown or Release) is the root-cause class here: when a request arrives with session_params.replace=true, create_req is supposed to tear down the existing session state before installing the replacement request. The vulnerable implementation iterated the live dictionary - "for _, req_node in self.req_nodes.items(): req_node.clear(self.req_nodes)" - while each req_node.clear() call removes entries from that same dictionary, producing a "dictionary changed size during iteration" RuntimeError (or otherwise corrupting teardown) inside the request-handling path. The proposed fix (PR #41483) takes a snapshot of the values, "for req_node in list(self.req_nodes.values()):", and only invokes clear() on nodes whose parent is None, so each branch root recursively releases its own subtree exactly once instead of every node racing to mutate the shared map. Regression tests added alongside the PR exercise both a unit-level Session.create_req call with a replacement request and an end-to-end path that opens a session via /open_session, creates a root and child generation via /generate, then issues a replace request and verifies the old root request ID is no longer usable. The trigger requires the session-control feature to be enabled and the session_params object to be accepted by the API.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable API (AV:N) with no special timing (AC:L) but requiring an authenticated session user (PR:L); only a low availability impact (A:L) from a crashing request, no C/I impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.create_req of the file python/sglang/srt/session/session_controller.py of the component Session Cleanup. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB