CVE-2026-110809

EUVD-2026-101799
A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.create_req of the file python/sglang/srt/session/session_controller.py of the component Session Cleanup. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 23.79%
Common Weakness Enumeration
References
https://gist.github.com/Yunzez/dbd254603fa2bc74358cb3647423d0ec#file-repro_sglang_session_replace_crash-py
https://github.com/sgl-project/sglang/
https://github.com/sgl-project/sglang/issues/41470
https://github.com/sgl-project/sglang/pull/41483
https://vuldb.com/cve/CVE-2026-110809
https://vuldb.com/submit/1004356
https://vuldb.com/vuln/420279
https://vuldb.com/vuln/420279/cti