Sgl-Project - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/sgl-project/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 19 Oct 2026 06:58:10 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRemote Denial of Service Vulnerability in SGLang Expert-Distribution Endpointhttps://feed.craftedsignal.io/briefs/2026-10-sg-lang-dos/Mon, 19 Oct 2026 06:58:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-sg-lang-dos/A remote denial of service vulnerability in the SGLang library allows unauthenticated attackers to disrupt service via the Expert-Distribution Recording Endpoint (CVE-2026-112082).A vulnerability identified as CVE-2026-112082 affects the sgl-project SGLang library in versions up to and including 0.5.19. The flaw resides within the Scheduler.expert_distribution_handle function, located in python/sglang/srt/eplb/expert_distribution.py. This component, identified as the Expert-Distribution Recording Endpoint, is susceptible to remote manipulation. Successful exploitation of this vulnerability results in a denial of service (DoS) state, potentially causing service instability or total unavailability for applications utilizing the affected SGLang component. Public exploit code is currently available, increasing the risk of exploitation by malicious actors. Organizations using SGLang for structured generation or large language model serving should identify if this specific endpoint is exposed and monitor for abnormal traffic patterns targeting this function.

Impact

Successful exploitation leads to a denial of service, rendering the affected SGLang endpoint unresponsive. This impacts organizations relying on SGLang for model inference or serving, potentially disrupting dependent AI/ML applications and services. The vulnerability is remotely exploitable, increasing the attack surface for internet-facing instances of SGLang.

Recommendation

  • Monitor for any unusual remote access to the Expert-Distribution Recording Endpoint until a patch is merged and deployed.
  • Audit application deployments to determine if the vulnerable python/sglang/srt/eplb/expert_distribution.py component is active and accessible.
  • Subscribe to sgl-project repository updates to identify when the pending pull request for CVE-2026-112082 is merged and released in a patched version.
  • If the endpoint is not required for production operations, restrict access via firewall or load balancer rules.
]]>lowadvisory