Key points
- SGLang versions up to and including 0.5.22 are affected by CVE-2026-112266.
- The vulnerability has a CVSS score of 8.2, classified as high severity.
- Attackers can trigger denial of service by supplying short, single-character request IDs.
SGLang versions through 0.5.22 contain a denial of service vulnerability that allows API clients to interrupt other users' active generation tasks. According to the National Vulnerability Database record for CVE-2026-112266, the flaw carries a CVSS score of 8.2, which is rated as high severity. The issue stems from how the software handles client-controlled request identifiers, specifically within the prefix-matching abort logic used for streaming connections.
In plain English
The vulnerability exists because the system relies on request IDs to manage active tasks. An attacker can submit a streaming generation request using a very short identifier, such as a single hexadecimal character. When the attacker disconnects, the system attempts to abort requests that match this short prefix. Because the identifier is so brief, it matches many other active requests from different users. This causes the system to terminate those legitimate tasks, effectively denying service to other clients sharing the same API endpoint.
The background
The weakness is categorized under CWE-187, which relates to numeric errors, though the practical impact here is a logic flaw in request handling. The affected component is the sgl-project sglang library. The vulnerability allows an attacker to influence the state of other users' sessions without needing to authenticate as them, provided they can send valid API requests. The abort logic was designed to cancel specific tasks but fails to isolate them when the identifying string is too short and generic.
What changes now
No patch or fix has been confirmed yet for this vulnerability. Users running SGLang versions up to 0.5.22 remain exposed to this denial of service vector. The National Vulnerability Database lists the issue as active with no mitigation software update available at this time. Organizations relying on this library for AI generation tasks must monitor for vendor announcements regarding a security update. Until a fix is released, the risk of disrupted service remains present for any exposed API endpoints.
Who needs to act first
Teams managing SGLang deployments should prioritize systems that expose the API to untrusted or semi-trusted users. Check whether your environment allows external clients to initiate streaming requests. If so, review access controls to limit who can send generation requests. Consider isolating critical workloads on separate instances or using network segmentation to restrict API access. Monitor logs for unusual patterns of short request IDs or frequent disconnections, which may indicate probing or exploitation attempts.
Background: Network segmentation
Network segmentation for security divides a large network into smaller, isolated subnetworks. This containment strategy limits the blast radius of an intrusion. Attackers cannot move freely between segments, protecting critical assets even if one zone is compromised. It reduces risk without requiring every device to be perfectly secured.
Read the full guide: Network Segmentation for Security: Isolating Threats and Limiting Damage
What to do and how to stay safe: SGLang
- Review your API access policies to ensure only authorized users can send generation requests to SGLang instances.
- Monitor server logs for anomalies such as a high volume of requests with unusually short or single-character identifiers.
- Implement rate limiting on the API endpoints to reduce the potential impact of rapid-fire denial of service attempts.
- Wait for the vendor to release an official update before applying any unofficial patches or workarounds.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of SGLang are vulnerable to this denial of service flaw?
SGLang versions up to and including 0.5.22 are affected by CVE-2026-112266.
How does an attacker exploit this vulnerability?
Attackers submit streaming requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates other clients' requests.
Is there a fix available for CVE-2026-112266?
No fix has been confirmed yet according to the available source material.
