SGLang: Denial of service via cross-request abort through rid prefix matching
Summary
SGLang through version 0.5.22 allows an API client to abort other users' in-flight generation requests. The attacker sends streaming /generate requests with a short, client-controlled rid (for example a single hex character) and disconnects, which triggers prefix-matching abort logic that terminates other clients' requests. The vector indicates an availability impact only, with no confidentiality or integrity impact. Exploitation requires network access to the API but no privileges or user interaction, and the attack complexity is rated high.
Affected
- sgl-project SGLang, versions 0 to 0.5.22 (per CVE record and VulnCheck)
Fixed in
Unknown. No fixed version has been published.
Workaround
- No vendor mitigation is published.
- Do not expose the SGLang API directly to untrusted clients; place an authenticating gateway or reverse proxy in front of it and restrict network access to known callers.
- Where several tenants share one instance, give each tenant its own instance.
Exploitation
- No known exploitation in the wild; KEV status not marked.
- CISA SSVC lists exploitation as proof of concept, with automatable: no.
- VulDB reports no exploit exists; a detailed technical write-up is public in GitHub issue #45002.
Our recommendation
- Inventory SGLang instances and confirm whether any run version 0.5.22 or earlier.
- Determine whether the API is reachable by untrusted or multi-tenant clients and restrict access now.
- Monitor for unusual client disconnects or aborts.
- Check the SGLang releases and GitHub issues #41474 and #45002 for a fix and upgrade once available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory: SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching www.vulncheck.com
- GitHub issue #45002 (SGLang) github.com
- GitHub issue #41474 (SGLang) github.com
- SGLang v0.5.22 scheduler.py github.com
- SGLang v0.5.22 tokenizer_manager.py github.com
- VulDB entry 422367 vuldb.com
- CERT/CC VU#665416 kb.cert.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:45.
Original description (NVD)
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates all other clients' requests.
NVD references (7)
- https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/managers/scheduler.py#L5458-L5590
- https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/managers/tokenizer_manager.py#L2240-L2256
- https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/managers/tokenizer_manager.py#L2425-L2436
- https://github.com/sgl-project/sglang/issues/41474
- https://github.com/sgl-project/sglang/issues/45002
- https://www.vulncheck.com/advisories/sglang-through-0.5.22-cross-request-abort-via-rid-prefix-matching
- https://github.com/sgl-project/sglang/issues/41474
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.