{"id":"CVE-2026-112082","summary":"sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service","details":"A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.","modified":"2026-10-21T02:55:50.694802377Z","published":"2026-10-19T05:30:22.073Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112082.json","unresolved_ranges":[{"extracted_events":[{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.5.0"},{"last_affected":"0.5.0"}],"source":"AFFECTED_FIELD"}]}],"cna_assigner":"VulDB","cwe_ids":["CWE-404"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112082.json"},{"type":"WEB","url":"https://github.com/sgl-project/sglang/"},{"type":"REPORT","url":"https://github.com/sgl-project/sglang/issues/42071"},{"type":"FIX","url":"https://github.com/sgl-project/sglang/pull/42098"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112082"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-112082"},{"type":"ADVISORY","url":"https://vuldb.com/submit/1009918"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/421761"},{"type":"REPORT","url":"https://vuldb.com/vuln/421761/cti"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sgl-project/sglang","events":[{"introduced":"97a38ee85ba62e268bde6388f1bf8edfe2ca9d76"},{"last_affected":"0bcd822377da7b5718e674eaf9c870d349424dd1"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0.5.1"},{"last_affected":"0.5.1"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.5.2"},{"last_affected":"0.5.2"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.5.3"},{"last_affected":"0.5.3"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"0.5.4"},{"last_affected":"0.5.4"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.5.5"},{"last_affected":"0.5.5"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.5.6"},{"last_affected":"0.5.6"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"0.5.7"},{"last_affected":"0.5.7"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.5.8"},{"last_affected":"0.5.8"}]},{"range":[{"introduced":"0.5.9"},{"last_affected":"0.5.9"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.5.10"},{"last_affected":"0.5.10"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.5.11"},{"last_affected":"0.5.11"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.5.12"},{"last_affected":"0.5.12"}]},{"range":[{"introduced":"0.5.13"},{"last_affected":"0.5.13"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"0.5.14"},{"last_affected":"0.5.14"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"0.5.15"},{"last_affected":"0.5.15"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.5.16"},{"last_affected":"0.5.16"}]},{"range":[{"introduced":"0.5.17"},{"last_affected":"0.5.17"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"0.5.18"},{"last_affected":"0.5.18"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.5.19"},{"last_affected":"0.5.19"}]}]}}],"versions":["0.5.1","0.5.10","0.5.11","0.5.12","0.5.13","0.5.14","0.5.15","0.5.16","0.5.17","0.5.18","0.5.19","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.5.8","0.5.9","v0.5.19","gateway-v0.3.1","gateway-v0.3.0","v0.5.6.post2","gateway-v0.2.4","v0.5.6.post1","v0.5.6","v0.5.5","v0.5.5.post3","gateway-v0.2.3","v0.5.5.post2","v0.5.5.post1","v0.5.4.post3","v0.5.4.post2","gateway-v0.2.2","v0.5.4.post1","v0.5.4","gateway-v0.2.1","v0.5.3.post3","v0.5.3.post2","gateway-v0.2.0","v0.5.3.post1","v0.5.3","v0.5.3rc2","v0.5.3rc1","v0.5.3rc0","v0.5.2","v0.5.2rc2","v0.5.2rc1","v0.5.2rc0","v0.5.1.post3","v0.5.1.post2","v0.5.1.post1","v0.5.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112082.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P"}]}