CVE-2026-112082

Overview

The CVE-2026-112082 vulnerability affects the SGLang library (up to version 0.5.19) in the Expert‑Distribution Recording Endpoint. It allows remote attackers to trigger a denial‑of‑service by manipulating the Scheduler.expert_distribution_handle function. The flaw is publicly documented and the fix is pending merge.

Description

A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.

Impact

Denial of service can interrupt the availability of services relying on the Expert‑Distribution Recording Endpoint. Confidentiality and integrity are not directly compromised, but the availability loss can disrupt operations. Defenders should monitor for abnormal traffic to the endpoint and consider rate limiting or temporary shutdown until a patch is applied.

Remediation

Upgrade SGLang to a version that includes the fix (post‑0.5.19) or apply the pending patch once merged. In the interim, restrict network access to the Expert‑Distribution Recording Endpoint, enable strict input validation, and implement rate limiting to mitigate DoS attempts.

Risk context

High severity (CVSS 7.5/8.7) with a low EPSS of 0.00626 indicates a moderate likelihood of exploitation but significant impact if successful. Defenders should treat this as a priority to prevent service disruption.

Affected products

• SGLang 0.5.19
• SGLang 0.5.18
• SGLang 0.5.17
• SGLang 0.5.16
• SGLang 0.5.15
• SGLang 0.5.14
• SGLang 0.5.13
• SGLang 0.5.12