CVE-2026-112082
Deferred Deferred - Pending Action

Expert Distribution DoS in SGLang

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112082
EUVD
EUVD-2026-104079

Affected Vendors & Products

Showing 20 associated CPEs
Vendor Product Version / Range
sgl-project SGLang 0.5.0
sgl-project SGLang 0.5.1
sgl-project SGLang 0.5.2
sgl-project SGLang 0.5.3
sgl-project SGLang 0.5.4
sgl-project SGLang 0.5.5
sgl-project SGLang 0.5.6
sgl-project SGLang 0.5.7
sgl-project SGLang 0.5.8
sgl-project SGLang 0.5.9
sgl-project SGLang 0.5.10
sgl-project SGLang 0.5.11
sgl-project SGLang 0.5.12
sgl-project SGLang 0.5.13
sgl-project SGLang 0.5.14
sgl-project SGLang 0.5.15
sgl-project SGLang 0.5.16
sgl-project SGLang 0.5.17
sgl-project SGLang 0.5.18
sgl-project SGLang 0.5.19

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in SGLang up to version 0.5.19, specifically in the Expert-Distribution Recording Endpoint. It involves the function Scheduler.expert_distribution_handle in the file python/sglang/srt/eplb/expert_distribution.py. The issue allows remote attackers to cause a denial of service by manipulating the system through exposed HTTP routes. A public exploit is available, and a fix is pending acceptance.

Detection Guidance

Monitor HTTP requests to the vulnerable endpoints (/start_expert_distribution_record, /stop_expert_distribution_record, /dump_expert_distribution_record) on SGLang servers. Check for server crashes or health check failures after accessing these routes without the --expert-distribution-recorder-mode flag.

Impact Analysis

This vulnerability can cause your SGLang server to crash and become unavailable. If exploited, it may lead to service disruption, including the inability to handle subsequent requests like health checks. The attack can be launched remotely without authentication, making it a significant risk for systems using affected versions.

Compliance Impact

This vulnerability causes a denial of service by crashing the server when specific HTTP endpoints are accessed without proper configuration. For compliance with GDPR or HIPAA, which require availability and integrity of systems processing sensitive data, such disruptions could lead to violations if they impact services handling personal or health information.

Mitigation Strategies

Apply the pending pull request fix (PR #42098) to validate recorder mode before processing requests. Temporarily disable the vulnerable endpoints if the fix is not yet applied. Ensure servers are running with the --expert-distribution-recorder-mode flag if expert distribution recording is required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112082. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart