CVE-2026-93838: SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx
SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handlestagingreq() that fails to validate chunkidx from ZMQ STAGINGREQ frames in prefill/decode disaggregation deployments. Attackers with access to the decode engine's internal ZMQ rank port can send a frame with an extremely large chunkidx value, causing the scheduler to allocate memory until the system runs out and terminates the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SGLangto a version that resolves this vulnerability.Fixed in 0.5.20 - Compensating control
Restrict network access to the decode engine internal ZMQ rank port so only trusted sources can send ZMQ frames (prevent malicious STAGING_REQ frames with crafted chunk_idx values).
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects SGLang prefill/decode disaggregation deployments where the decode engine's internal ZMQ rank port is reachable by an attacker. Deployments that do not expose access to that internal port are not described as exploitable by the available information.
What does an attacker need to do to trigger the denial of service?
An attacker needs access to the decode engine's internal ZMQ rank port and must send a ZMQ STAGING_REQ frame containing an extremely large chunk_idx value. No authentication or user interaction requirements are listed in the provided severity vector.
What is the expected impact of successful exploitation?
The scheduler can allocate memory until system memory is exhausted, causing the process to terminate. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.
What can be done if an update is not immediately possible?
Restrict access to the decode engine's internal ZMQ rank port so untrusted parties cannot send STAGING_REQ frames. This directly removes the access condition described for exploitation.