{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asgl-projectsg-lang/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sgl-project:sg-lang:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-112082"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SGLang (\u003c= 0.5.19)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["sgl-project"],"content_html":"\u003cp\u003eA vulnerability identified as CVE-2026-112082 affects the sgl-project SGLang library in versions up to and including 0.5.19. The flaw resides within the \u003ccode\u003eScheduler.expert_distribution_handle\u003c/code\u003e function, located in \u003ccode\u003epython/sglang/srt/eplb/expert_distribution.py\u003c/code\u003e. This component, identified as the Expert-Distribution Recording Endpoint, is susceptible to remote manipulation. Successful exploitation of this vulnerability results in a denial of service (DoS) state, potentially causing service instability or total unavailability for applications utilizing the affected SGLang component. Public exploit code is currently available, increasing the risk of exploitation by malicious actors. Organizations using SGLang for structured generation or large language model serving should identify if this specific endpoint is exposed and monitor for abnormal traffic patterns targeting this function.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to a denial of service, rendering the affected SGLang endpoint unresponsive. This impacts organizations relying on SGLang for model inference or serving, potentially disrupting dependent AI/ML applications and services. The vulnerability is remotely exploitable, increasing the attack surface for internet-facing instances of SGLang.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor for any unusual remote access to the Expert-Distribution Recording Endpoint until a patch is merged and deployed.\u003c/li\u003e\n\u003cli\u003eAudit application deployments to determine if the vulnerable \u003ccode\u003epython/sglang/srt/eplb/expert_distribution.py\u003c/code\u003e component is active and accessible.\u003c/li\u003e\n\u003cli\u003eSubscribe to sgl-project repository updates to identify when the pending pull request for CVE-2026-112082 is merged and released in a patched version.\u003c/li\u003e\n\u003cli\u003eIf the endpoint is not required for production operations, restrict access via firewall or load balancer rules.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T06:58:10Z","date_published":"2026-10-19T06:58:10Z","id":"https://feed.craftedsignal.io/briefs/2026-10-sg-lang-dos/","summary":"A remote denial of service vulnerability in the SGLang library allows unauthenticated attackers to disrupt service via the Expert-Distribution Recording Endpoint (CVE-2026-112082).","title":"Remote Denial of Service Vulnerability in SGLang Expert-Distribution Endpoint","url":"https://feed.craftedsignal.io/briefs/2026-10-sg-lang-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:sgl-Project:sg-Lang:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}