CVE-2026-110807: sgl-project SGLang generate Endpoint io_struct.py denial of service
A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file python/sglang/srt/managers/iostruct.py of the component generate Endpoint. This manipulation of the argument sessionparams causes denial of service. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker with low privileges can exploit the generate endpoint by manipulating the session_params argument. No user interaction is required.
What is the impact of a successful attack?
Successful exploitation can cause a denial of service. The available information does not identify confidentiality or integrity impact.
Which versions are affected?
SGLang versions up to and including 0.5.19 are identified as affected. No fixed version is provided.
Is public exploit code available?
Yes. The exploit has been made publicly available and could be used in attacks.
What can be done if a patch is not available?
The provided information does not describe a vendor fix or workaround. Until remediation details are available, restrict access to the generate endpoint to trusted, authenticated users where possible.