CVE-2026-110809: sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service
A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.createreq of the file python/sglang/srt/session/sessioncontroller.py of the component Session Cleanup. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
Which SGLang deployments are affected?
SGLang versions up to and including 0.5.19 are reported as affected. The issue is in the Session Cleanup component, specifically Session.create_req in python/sglang/srt/session/session_controller.py.
What access does an attacker need to exploit this issue?
The issue can be exploited remotely and has low attack complexity. The reported vector requires low-level privileges, so it is not described as an unauthenticated attack.
What is the likely impact?
Successful exploitation can cause denial of service. The supplied severity vector reports availability impact only, with no reported confidentiality or integrity impact.
Is an exploit available?
Yes. The exploit has been publicly disclosed and may be used.
What should teams do if no accepted fix is available yet?
The provided information says the pull request intended to fix the issue is still awaiting acceptance. Until an accepted fix is available, restrict low-privileged remote access to affected SGLang session functionality where possible and monitor for denial-of-service conditions.