CVE-2026-10775: sgl-project SGLang denial of service in Cache Handler

CVE-2026-10775 · Severity: low · CVSS 3.6 · Published 2026-06-03

SGLang is a high-performance serving framework for large language models that caches multimodal embeddings to improve response times. A flaw in its cache key generation logic allows local attackers to craft inputs that collide in the cache, either crashing the service or causing it to return incorrect embeddings for subsequent requests. This affects the reliability and correctness of multimodal AI inference services built on SGLang.

Technologies: sglang (PyPI), SGLang Project SGLang. Vendors: PyPI, SGLang Project.

Quick answers

Is CVE-2026-10775 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-10775 being exploited in the wild.
How severe is CVE-2026-10775?
Low severity, with a CVSS score of 3.6, published 3 June 2026.
Which products and versions are affected?
sglang (PyPI) ECOSYSTEM:introduced=0,last_affected=0.5.11; SGLang Project SGLang up to 0.5.11.
Is there a fix for CVE-2026-10775?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10775 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-10775?
Check whether you run sglang (PyPI) or SGLang Project SGLang at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in SGLang's multimodal cache handler (mm_utils.py and multimodal_cache.py) and involves multiple hash collision issues in the data_hash, tensor_hash, and hash_feature functions. The data_hash function truncates SHA256 output to 64 bits (8 bytes), reducing the birthday-bound collision threshold from 2^128 to approximately 2^32. Additionally, tensor_hash flattens and concatenates tensor lists without encoding per-tensor boundaries, dtype, or shape information, allowing different tensor partitions with identical concatenated bytes to produce identical hashes. The np.ndarray branch hashes only arr.tobytes(), so arrays with different shapes or dtypes can collide. Furthermore, non-tensor list inputs passed to hash_feature trigger a TypeError when passed to data_hash. An attacker with local system access and low privileges can exploit this by providing malicious multimodal inputs that hash to the same cache key, causing cache poisoning, incorrect embeddings, or service crashes. No patch has been released as of the advisory date; a pull request is pending acceptance.

Affected products

  • sgl-project SGLang <= 0.5.11

Identifiers

  • CVE-2026-10775
  • GHSA-jrcc-j37m-v8fg
  • PYSEC-2026-3695

Timeline

  • 2026-05-16: disclosed: Bug reported in GitHub issue #25462
  • 2026-06-04: advisory: GitHub Advisory Database published
  • 2026-06-04: other: Fix pull request #22033 awaits acceptance

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.