CVE-2026-112266 (CVSS 5.9)

Description

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates all other clients' requests.

Is your site exposed to CVE-2026-112266?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.9

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploit Prediction

0.0042

Probability of exploitation

0.36%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-187 CWE-187

References

Other References

https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/managers/scheduler.py#L5458-L5590 https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/managers/tokenizer_manager.py#L2240-L2256 https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/managers/tokenizer_manager.py#L2425-L2436 https://github.com/sgl-project/sglang/issues/41474 https://github.com/sgl-project/sglang/issues/45002 https://www.vulncheck.com/advisories/sglang-through-0.5.22-cross-request-abort-via-rid-prefix-matching https://github.com/sgl-project/sglang/issues/41474

Frequently Asked Questions

What is CVE-2026-112266? +

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates all other clients' requests. It has a CVSS v3.1 base score of 5.9 (MEDIUM).

How severe is CVE-2026-112266? +

CVE-2026-112266 has a CVSS v3.1 score of 5.9 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0042, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-112266? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-41110 9.9

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions …

CVE-2024-39742 8.1

IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due …

CVE-2026-94576 8.0

An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d …

CVE-2026-87853 7.5

A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with …

CVE-2026-101914 6.5

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the …

CVE-2026-44837 5.9

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, …

CVE-2026-112266