HIGH 8.7 NVD
CVE-2026-102634
SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer ba
SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstrap_room values to crash scheduler processes or hang other users' requests until transfer timeout.
References
- https://github.com/sgl-project/sglang
- https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/common
- https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/decode
- https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/moonca
- https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/managers/io_struct.py
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-09-29 via NVD.
vulnfeed aggregates 10239 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.