SGLang: a one-character request id lets any client abort every other client's in-flight generation

CVSS 8.2CVE-2026-112266AI/ML frameworks & servingcurated

Impact

SGLang matches abort requests against request ids by prefix. A client that submits a streaming /generate request with a single hex character as its rid and then disconnects triggers abort logic that matches - and terminates - every other in-flight request on the scheduler. On a shared inference endpoint one cheap request wipes out all concurrent tenants' generations; repeated, it keeps the server producing nothing while the GPUs stay allocated. The engine itself survives, so this shows up as mass client-side truncation rather than a crash, which makes it easy to misread as a network fault.

Who can reach it

Anyone who can reach the SGLang HTTP API. The record indicates no authentication is required (PR:N); the attacker only needs to be able to open and drop a streaming request.

What to do

No fixed version is named in the record - SGLang through 0.5.22 is affected and the upstream issues (41474, 45002) were still open. Until a release lands, put the API behind a gateway that assigns or validates rids server-side (reject client-supplied short rids) and do not expose the endpoint to untrusted clients. Any fix will be a Python-level change applied by restarting the server process.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-112266 https://github.com/sgl-project/sglang/issues/41474 https://github.com/sgl-project/sglang/issues/45002 https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/managers/tokenizer_manager.py#L2240-L2256

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.