CVE-2026-111392 sgl-project CVE debrief

Who should care

Defenders responsible for SGLang deployments, especially those using version 0.5.21 or earlier, should assess exposure and verify cache management configurations. This includes operators, platform administrators, vulnerability management teams, and security teams who need to prioritize verifying exposure and implementing compensating controls.

Why it matters

CVE-2026-111392 allows remote attackers to poison cached KV entries in SGLang through 0.5.21, potentially disclosing sensitive image content or corrupting victim responses. Defenders should prioritize verifying exposure, especially in SGLang deployments using version 0.5.21 or earlier, and assess the feasibility of cache poisoning attacks. Additional verification is needed to confirm affected versions and potential impact.

• Potential disclosure of sensitive image content
• Corruption of victim responses
• Cache poisoning attacks may require verification of affected versions and configurations
• Defenders should prioritize verifying exposure and implementing compensating controls

Technical summary

SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. This could lead to disclosure of sensitive image content or corruption of victim responses. Defenders should assess exposure, especially in SGLang deployments using version 0.5.21 or earlier, and verify cache management configurations. Technical framing indicates that cache poisoning attacks may require verification of affected versions and configurations.

Defensive priority

Defenders should prioritize verifying exposure in SGLang deployments, especially those using version 0.5.21 or earlier, and assess the feasibility of cache poisoning attacks.

Recommended defensive actions

• Verify SGLang version and assess exposure to cache poisoning attacks
• Review and update cache management configurations
• Monitor for suspicious activity and implement compensating controls
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional verification is needed to confirm affected versions and potential impact. Source grounding indicates that SGLang through 0.5.21 trusts caller-supplied mm_hashes values, and defenders should verify cache management configurations. Evidence limits suggest that further review of cache poisoning attacks and affected scope is necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.