CVE-2026-111392: SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate

Q: Which deployments are exposed?

Deployments running SGLang through 0.5.21 are exposed if remote clients can submit requests to the /generate endpoint and multimodal prefix-cache entries are used.

Q: What does an attacker need to exploit this?

The attacker needs network access to /generate and must supply a different image with an mm_hashes value that is known or can be predicted for a cached entry. No privileges or user interaction are required.

Published Oct 16, 2026

Updated

SGLang through 0.5.21 trusts caller-supplied mmhashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash via /generate to disclose another request's image content or corrupt victims' responses.

Affected Software

1 affected component

SGLang SGLang<=0.5.21

Event History

Oct 16, 2026

CVE Published

via MITRE·05:38 PM

Data Sourced

via MITRE·05:38 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments running SGLang through 0.5.21 are exposed if remote clients can submit requests to the /generate endpoint and multimodal prefix-cache entries are used.

What does an attacker need to exploit this?

The attacker needs network access to /generate and must supply a different image with an mm_hashes value that is known or can be predicted for a cached entry. No privileges or user interaction are required.

CVE-2026-111392: SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?