Executive brief
SGLang is an open-source framework used for serving large language models (LLMs). A vulnerability in its LoRA (Low-Rank Adaptation) management component allows a remote attacker to crash the inference server by sending specific concurrent requests. This results in a denial of service, making the AI model unavailable to users and requiring a manual restart of the service.
Technical details
A Reachable Assertion (CWE-617) exists in SGLang versions up to 0.5.10.post1 within the `python/sglang/srt/lora/lora_manager.py` file. The vulnerability is triggered when the scheduler constructs a batch containing more LoRA adapters than the limit defined by `--max-loras-per-batch`. Specifically, if concurrent requests arrive for N adapters plus a base-model request, the scheduler fails to enforce the cap, leading to a hard assertion failure in `lora_manager.fetch_new_loras()`. This unhandled exception propagates, causing the scheduler process to terminate and the HTTP inference endpoint to become unresponsive. While the attack can be launched remotely, it is classified as high complexity because it requires precise timing of concurrent requests to specific adapter configurations. A fix has been proposed in the project's repository.
Affected products
- sgl-project SGLang <= 0.5.10.post1
Timeline
- 2026-06-01: disclosed: NVD publication date
- 2026-06-02: advisory: GitHub Advisory published