CVE-2026-112266: SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching

Q: Who can exploit this issue?

Any API client able to submit streaming /generate requests can exploit it; no authentication or user interaction is required according to the supplied severity vector. The attacker uses a short, client-controlled rid and disconnects.

Q: What deployments are exposed?

SGLang versions through 0.5.22 are affected where clients can access the streaming /generate endpoint. Other clients must have in-flight generation requests for the attack to cause cross-request aborts.

Q: What is the practical impact?

An attacker can terminate other users' active generation requests, causing a denial of service. The provided vector indicates availability impact only, with no stated confidentiality or integrity impact.

Published Oct 19, 2026

Updated

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates all other clients' requests.

Affected Software

1 affected component

SGLang SGLang<=0.5.22

Event History

Oct 19, 2026

CVE Published

via MITRE·01:55 PM

Data Sourced

via MITRE·01:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any API client able to submit streaming /generate requests can exploit it; no authentication or user interaction is required according to the supplied severity vector. The attacker uses a short, client-controlled rid and disconnects.

What deployments are exposed?

SGLang versions through 0.5.22 are affected where clients can access the streaming /generate endpoint. Other clients must have in-flight generation requests for the attack to cause cross-request aborts.

What is the practical impact?

An attacker can terminate other users' active generation requests, causing a denial of service. The provided vector indicates availability impact only, with no stated confidentiality or integrity impact.

CVE-2026-112266: SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What deployments are exposed?

What is the practical impact?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What deployments are exposed?

What is the practical impact?