CVE-2026-112082 sgl-project CVE debrief

Who should care

Defenders responsible for SGLang deployments, especially those using versions up to 0.5.19, should assess exposure and monitor for potential denial-of-service attacks. They must prioritize remediation based on the pull request status and potential operational impacts. Security teams and vulnerability management teams should also review and apply the pull request to fix the issue.

Why it matters

CVE-2026-112082 is a denial-of-service vulnerability in sgl-project SGLang up to 0.5.19. Defenders should verify exposure, monitor for potential attacks, and prioritize remediation based on the pull request status.

• Denial-of-service attacks may occur due to the publicly available exploit
• Defenders need to verify exposure in their SGLang deployments
• Remediation priority is uncertain pending pull request acceptance

Technical summary

The vulnerability affects the Scheduler.expert_distribution_handle function in python/sglang/srt/eplb/expert_distribution.py, leading to denial of service. The attack can be launched remotely, and a public exploit is available. This issue impacts SGLang deployments, particularly those using versions up to 0.5.19. Defenders should verify exposure and monitor for potential denial-of-service attacks. The pull request to fix this issue awaits acceptance, and defenders should prioritize remediation based on its status and potential operational impacts.

Defensive priority

Defenders should prioritize verifying exposure in their SGLang deployments, especially those using versions up to 0.5.19, and monitor for potential denial-of-service attacks.

Recommended defensive actions

• Verify SGLang version and check for Expert-Distribution Recording Endpoint usage
• Monitor for potential denial-of-service attacks
• Review and apply the pull request to fix the issue
• Perform vulnerability assessment to identify potential attack vectors
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Review relevant monitoring, detection, and logs for exposed assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in sgl-project SGLang. However, the corpus does not establish versions beyond 0.5.19, exploitation, impact, or remediation, requiring verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.