CVE-2026-112083 sgl-project CVE debrief

Who should care

Defenders responsible for SGLang deployments, vulnerability management teams, and security operators should assess exposure and prioritize verification and remediation efforts. They should verify the affected version of SGLang, review the official advisory, and apply the available pull request to fix the issue, while also monitoring for updates and reviewing compensating controls for exposed systems.

Why it matters

CVE-2026-112083 is a medium-severity denial of service vulnerability in sgl-project SGLang up to 0.5.19. Defenders responsible for SGLang deployments should assess exposure and prioritize verification and remediation efforts.

• Denial of service attacks may be launched against vulnerable SGLang instances.
• Defenders should verify the affected version of SGLang and apply the available pull request to fix the issue.
• Remediation priority is medium due to the availability of a pull request to fix the issue.

Technical summary

The function WeightExporter.send_weights_to_remote_instance in the file python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of the component Weight Exporter is affected by a denial of service vulnerability. The vulnerability can be triggered by manipulating the argument group_name, potentially leading to a denial of service attack against vulnerable SGLang instances. Defenders should prioritize verifying the affected version of SGLang and applying the available pull request to fix the issue.

Defensive priority

Defenders should prioritize verifying the affected version of SGLang and applying the available pull request to fix the issue.

Recommended defensive actions

• Verify the version of SGLang being used and check if it is affected by the vulnerability.
• Apply the available pull request to fix the issue.
• Monitor the official sources for updates on the vulnerability and remediation steps.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide information about the vulnerability in sgl-project SGLang up to 0.5.19, affecting the function WeightExporter.send_weights_to_remote_instance. However, the affected versions, remediation steps, and specific technical details require verification from official sources. Defenders should verify the affected version of SGLang, review the official advisory, and apply the available pull request to fix the issue, while also monitoring for updates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.