CVE-2026-110807
sgl-project SGLang generate Endpoint io_struct.py denial of service
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file python/sglang/srt/managers/io_struct.py of the component generate Endpoint. This manipulation of the argument session_params causes denial of service. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
| CWE | CWE-404 |
| Vendor | sgl-project |
| Product | sglang |
| Published | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for sgl-project sglang
Be the first to know when new medium vulnerabilities affecting sgl-project sglang are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
sgl-project / SGLang
0.5.0 0.5.1 0.5.2 0.5.3 0.5.4 0.5.5 0.5.6 0.5.7 0.5.8 0.5.9 0.5.10 0.5.11 0.5.12 0.5.13 0.5.14 0.5.15 0.5.16 0.5.17 0.5.18 0.5.19
References
vuldb.com: https://vuldb.com/vuln/420278 vuldb.com: https://vuldb.com/vuln/420278/cti vuldb.com: https://vuldb.com/cve/CVE-2026-110807 vuldb.com: https://vuldb.com/submit/1004351 github.com: https://github.com/sgl-project/sglang/issues/41467 github.com: https://github.com/sgl-project/sglang/pull/41535 gist.github.com: https://gist.github.com/Yunzez/28820d220c52de4810fd5fb2d1dcf409#file-repro_sglang_session_params_crash-py github.com: https://github.com/sgl-project/sglang/
Credits
🔍 Zyz3366 (VulDB User) VulDB CNA Team