SGLang versions up to 0.5.19 in disaggregation mode expose an unauthenticated PUT /route endpoint allowing remote attackers to poison KV transfer tables and redirect sensitive data.
SGLang
routing-poisoning
cve-2026-92972
denial-of-service
vulnerability
1r
2t
1c
updated