CVE-2026-112082
7.5HighPublished 19 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-404
Impact
Remote, unauthenticated attackers can crash the SGLang service via denial of service with public exploit code. They only need network access to reach the Expert-Distribution recording endpoint.
Root cause
Improper resource shutdown or release handling (CWE-404) in Scheduler.expert_distribution_handle within python/sglang/srt/eplb/expert_distribution.py causes service failure.
Affected systems
sgl-project SGLang up to 0.5.19
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
No fixed release is published yet as the patch PR remains pending; restrict network access to the SGLang instance or firewall the Expert-Distribution endpoint until the upstream pull request merges.
$ pip show sglangAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.