SGLang EUVD-2026-104080

Requires that the target SGLang deployment actually uses the remote weight-export feature and that the send_weights_to_remote_instance code path is reachable by the attacker. The specific trigger is supplying a group_name that has not been registered via init_weights_send_group_for_remote_instance, which the pre-patch code looks up with a direct dict index, raising an unhandled KeyError. Limiting factors: impact is confined to a limited availability loss (VA:L) of the export operation rather than full service compromise; exploitation is only possible where the weight-export RPC is exposed, and although the CVSS vector lists PR:N, the practical reachability of this internal model-management endpoint in a given deployment is the real gating factor. No user interaction is required.

This is a genuinely low-to-moderate priority issue despite the 'remote, unauthenticated' framing. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores only 5.5 because the sole impact is VA:L - a limited availability effect with no confidentiality or integrity consequence (VC:N/VI:N). The source-code evidence confirms the root cause: send_weights_to_remote_instance indexed self._weights_send_group[group_name] directly, so an attacker-supplied group_name that was never initialized raises an unhandled KeyError (CWE-404, improper resource handling), aborting that operation rather than crashing the whole service persistently. Exploitation status is 'publicly available exploit code exists' (POC on GitHub issue #42073) but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation - the CVSS 4.0 E:P (Proof-of-Concept) sub-metric corroborates that exploit maturity is only proof-of-concept, not weaponized. The report originates solely from VulDB, a source that tends to rate researcher-found issues aggressively; the PR:N (unauthenticated) rating should be treated cautiously because the affected code path is an internal model-weight-export RPC whose real-world reachability depends on whether that endpoint is exposed. Net: a real but minor availability bug, not a widespread-exploitation emergency.

An attacker with network reach to an SGLang instance that exposes the remote weight-export functionality invokes send_weights_to_remote_instance with a group_name that was never initialized via init_weights_send_group_for_remote_instance. The direct dict lookup raises an unhandled KeyError, causing a denial-of-service of that export operation. A proof-of-concept is publicly available (sgl-project/sglang issue #42073), and with AV:N/AC:L the condition is trivial to trigger once the endpoint is reachable.