{"id":"CVE-2026-112269","summary":"SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations","details":"SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations with unique mooncake_session_id values and large nested-buffer frames to exhaust Prefill memory until the scheduler is OOM-killed.","modified":"2026-10-24T02:48:34.488816442Z","published":"2026-10-19T13:55:17.954Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112269.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112269.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112269"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/sglang-through-0.5.22-memory-exhaustion-via-unauthenticated-mooncake-decode-registrations"},{"type":"REPORT","url":"https://github.com/sgl-project/sglang/issues/45012"},{"type":"PACKAGE","url":"https://github.com/sgl-project/sglang"},{"type":"ARTICLE","url":"https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/disaggregation/common/utils.py#L47-L69"},{"type":"ARTICLE","url":"https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/disaggregation/mooncake/conn.py#L2885-L2935"},{"type":"ARTICLE","url":"https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/disaggregation/mooncake/conn.py#L889-L909"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sgl-project/sglang","events":[{"introduced":"0"},{"last_affected":"baa9befa381511cd4d56f83980951e5a45fffc6d"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0"},{"last_affected":"0.5.22"}],"source":"AFFECTED_FIELD"},{"source":"DESCRIPTION","range":[{"introduced":"0"},{"last_affected":"0.5.22"}]}]}}],"versions":["v0.5.22","gateway-v0.3.1","gateway-v0.3.0","v0.5.6.post2","gateway-v0.2.4","v0.5.6.post1","v0.5.6","v0.5.5","v0.5.5.post3","gateway-v0.2.3","v0.5.5.post2","v0.5.5.post1","v0.5.4.post3","v0.5.4.post2","gateway-v0.2.2","v0.5.4.post1","v0.5.4","gateway-v0.2.1","v0.5.3.post3","v0.5.3.post2","gateway-v0.2.0","v0.5.3.post1","v0.5.3","v0.5.3rc2","v0.5.3rc1","v0.5.3rc0","v0.5.2","v0.5.2rc2","v0.5.2rc1","v0.5.2rc0","v0.5.1.post3","v0.5.1.post2","v0.5.1.post1","v0.5.1","v0.5.0rc2","v0.5.0rc1","v0.5.0rc0","gateway-v0.1.9","v0.4.10.post2","v0.4.10.post1","gateway-v0.1.8","gateway-v0.1.7","v0.4.10","v0.4.9.post6","v0.4.9.post5","v0.4.9.post4","v0.4.9.post3","gateway-v0.1.6","v0.4.9.post2","v0.4.9.post1","gateway-v0.1.5","v0.4.9","v0.4.8.post1","v0.4.8","v0.4.7.post1","v0.4.7","v0.4.6.post5","v0.4.6.post4","v0.4.6.post3","v0.4.6.post2","v0.4.6.post1","v0.4.6","v0.4.5.post3","v0.4.5.post2","v0.4.5.post1","v0.4.5","v0.4.4.post4","v0.4.4.post3","v0.4.4.post2","v0.4.4.post1","v0.4.4","v0.4.3.post4","v0.4.3.post3","v0.4.3.post2","v0.4.3.post1","v0.4.3","v0.4.2.post4","v0.4.2.post3","v0.4.2.post2","v0.4.2.post1","v0.4.2","v0.4.1.post7","v0.4.1.post6","v0.4.1.post5","v0.4.1.post4","v0.4.1.post3","v0.4.1.post2","v0.4.1.post1","v0.4.1","v0.4.0.post2","v0.4.0.post1","v0.4.0","v0.3.6.post3","v0.3.6.post2","v0.3.6.post1","v0.3.6","v0.3.5.post2","v0.3.5.post1","v0.3.5","v0.3.4.post2","v0.3.4.post1","v0.3.4","v0.3.3.post1","v0.3.3","v0.3.2","v0.3.1.post3","v0.3.1.post2","v0.3.1.post1","v0.3.0","v0.2.15","v0.2.14.post2","v0.2.14.post1","v0.2.14","v0.2.13","v0.2.12","v0.2.11","v0.2.10","v0.2.9.post1","v0.2.9","v0.2.8","v0.2.7","v0.2.6","v0.2.5","v0.2.0","v0.1.24","v0.1.23","v0.1.22","v0.1.21","v0.1.20","v0.1.19","v0.1.18","v0.1.17","v0.1.16","v0.1.15","v0.1.14","v0.1.13","v0.1.12","v0.1.11","v0.1.10","v0.1.9","v0.1.8","v0.1.7","v0.1.6","v0.1.5","v0.1.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112269.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}