CVE-2026-112270 | sgl-project SGLang up to 0.5.22 Mooncake disaggregation backend handle_staging_rsp chunk_idx allocation of resources

October 19, 2026 Yanac

A vulnerability marked as problematic has been reported in sgl-project SGLang up to 0.5.22. Affected is the function handle_staging_rsp of the component Mooncake disaggregation backend. This manipulation of the argument chunk_idx causes allocation of resources.

This vulnerability is tracked as CVE-2026-112270. The attack is possible to be carried out remotely. No exploit exists.VulDB Recent EntriesRead More