CVE-2026-112082: sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service
A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expertdistributionhandle of the file python/sglang/srt/eplb/expertdistribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
SGLang installations up to version 0.5.19 are affected when the Expert-Distribution Recording Endpoint, backed by Scheduler.expert_distribution_handle in python/sglang/srt/eplb/expert_distribution.py, is reachable by an attacker.
What access does an attacker need?
The vulnerability can be exploited remotely and requires no privileges or user interaction according to the supplied vector. Public exploit code is available.
What is the impact of successful exploitation?
Successful manipulation can cause a denial of service. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.
Is a fix available?
The reported pull request to fix the issue is still awaiting acceptance. No released fixed version is identified in the provided information.