CVE-2026-112083: sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service
A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.sendweightstoremoteinstance of the file python/sglang/srt/modelexecutor/modelrunnercomponents/weightexporter.py of the component Weight Exporter. Performing a manipulation of the argument groupname results in denial of service. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of sgl-project SGLang up to version 0.5.19 that use the Weight Exporter component are affected. The vulnerable behavior is in WeightExporter.send_weights_to_remote_instance.
What does an attacker need to exploit it?
The attack can be initiated remotely and does not require privileges or user interaction according to the supplied severity vector. Exploitation involves manipulating the group_name argument.
What is the impact of successful exploitation?
Successful exploitation can cause a denial of service. The provided information does not indicate confidentiality or integrity impact.
Is a fix available?
A pull request intended to fix the issue exists but was awaiting acceptance at the time of the provided information. No released fixed version is identified.
How urgent is mitigation?
A public exploit has been released and may be used in attacks. Prioritize limiting remote access to the affected Weight Exporter functionality while a confirmed fix is unavailable.