CVE-2026-102634CWE-694

CVE-2026-102634

High · published September 29, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
47.1
In the wild
Unconfirmed
What it is

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstrap_room values to crash scheduler processes or hang other users' requests until transfer timeout.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00582 · 47.1th percentile
Weakness
CWE-694 · Use of Multiple Resources with Duplicate Identifier
Published
2026-09-29T21:17Z
References (8)
https://github.com/sgl-project/sglang · [email protected]https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/common/conn.py#L392-L393 · [email protected]https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/decode.py#L942 · [email protected]https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/mooncake/conn.py#L2760-L2764 · [email protected]https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/managers/io_struct.py#L281 · [email protected]https://github.com/sgl-project/sglang/issues/40125 · [email protected]https://www.vulncheck.com/advisories/sglang-through-0.5.20-denial-of-service-via-duplicate-bootstrap-room · [email protected]https://github.com/sgl-project/sglang/issues/40125 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 1%
    epss
  • 29 SEP 16:04Z
    SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room
    cvelistv5