TI-2026-76470 Aliases CVE-2026-112270 GHSA-q322-x26r-gm37

Memory exhaustion in SGLang via Mooncake STAGING_RSP messages

LOW 31CWE-770Published 2026-10-19 · Updated 2026-10-19

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

SGLang through 0.5.22 with the Mooncake disaggregation backend allocates memory without limits in handle_staging_rsp(), tracked as CWE-770. An unauthenticated network-adjacent attacker can exhaust memory on the Prefill side by sending crafted STAGING_RSP messages, which causes the scheduler to be killed by the out-of-memory killer.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGING_RSP messages with huge chunk_idx values under fresh room IDs, causing the scheduler to be OOM-killed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00249 16th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sgl-project	sglang	up to 0.5.22	—	No fix listed	CNA

sglang Vendorsgl-project Affected up to 0.5.22 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for SGLang.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-19 Threatist record created from CVE-2026-112270
2026-10-19 Alias added: GHSA-q322-x26r-gm37

References

Other 3

TI-2026-76247 Denial of service in SGLang expert-distribution recording endpoint CVSS 4.0HIGH 8.7
TI-2026-70996 SGLang disables decompression bomb check, enabling denial of service CVSS 4.0HIGH 8.7
TI-2026-70994 SGLang Memory Exhaustion DoS via Qwen-VL Video Preprocessing CVSS 4.0HIGH 8.7
TI-2026-70993 Decompression amplification in SGLang load_audio exhausts memory CVSS 4.0HIGH 8.7
TI-2026-65453 SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room CVSS 4.0HIGH 8.7
TI-2026-75290 Code injection in SGLang debug dumper filter CVSS 4.0CRITICAL 9.2

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences