CVE-2026-110807

Deferred Deferred - Pending Action

Denial of Service in SGLang via Session Parameters Manipulation

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: VulDB

Description

A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file python/sglang/srt/managers/io_struct.py of the component generate Endpoint. This manipulation of the argument session_params causes denial of service. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110807

EUVD

EUVD-2026-101757

Affected Vendors & Products

Vendor	Product	Version / Range
sgl-project	SGLang	0.5.0
sgl-project	SGLang	0.5.1
sgl-project	SGLang	0.5.2
sgl-project	SGLang	0.5.3
sgl-project	SGLang	0.5.4
sgl-project	SGLang	0.5.5
sgl-project	SGLang	0.5.6
sgl-project	SGLang	0.5.7
sgl-project	SGLang	0.5.8
sgl-project	SGLang	0.5.9
sgl-project	SGLang	0.5.10
sgl-project	SGLang	0.5.11
sgl-project	SGLang	0.5.12
sgl-project	SGLang	0.5.13
sgl-project	SGLang	0.5.14
sgl-project	SGLang	0.5.15
sgl-project	SGLang	0.5.16
sgl-project	SGLang	0.5.17
sgl-project	SGLang	0.5.18
sgl-project	SGLang	0.5.19

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-404	The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service weakness in SGLang up to version 0.5.19. It involves manipulating the session_params argument in the generate Endpoint component's file python/sglang/srt/managers/io_struct.py. The attack can be executed remotely and has a public exploit available.

Detection Guidance

The provided CVE data does not include specific detection methods or commands for identifying this vulnerability on a network or system. The vulnerability involves a denial of service in SGLang up to version 0.5.19, but no technical details for detection are provided.

Impact Analysis

The vulnerability allows remote attackers to cause a denial of service by manipulating session parameters. This could disrupt services relying on SGLang, leading to downtime or degraded performance for applications using the affected component.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with standards like GDPR or HIPAA. The vulnerability causes denial of service via manipulation of session parameters, which could indirectly affect availability requirements in these regulations if exploited in critical systems.

Mitigation Strategies

Immediately upgrade SGLang to a version beyond 0.5.19 where the vulnerability is patched. If an update is not available, restrict network access to the generate endpoint and monitor for unusual session parameter manipulation attempts.

Hi! I’m here to help you understand CVE-2026-110807. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70