Executive brief
SGLang is a high-performance serving framework for large language models that caches multimodal embeddings to improve response times. A flaw in its cache key generation logic allows local attackers to craft inputs that collide in the cache, either crashing the service or causing it to return incorrect embeddings for subsequent requests. This affects the reliability and correctness of multimodal AI inference services built on SGLang.
Technical details
The vulnerability exists in SGLang's multimodal cache handler (mm_utils.py and multimodal_cache.py) and involves multiple hash collision issues in the data_hash, tensor_hash, and hash_feature functions. The data_hash function truncates SHA256 output to 64 bits (8 bytes), reducing the birthday-bound collision threshold from 2^128 to approximately 2^32. Additionally, tensor_hash flattens and concatenates tensor lists without encoding per-tensor boundaries, dtype, or shape information, allowing different tensor partitions with identical concatenated bytes to produce identical hashes. The np.ndarray branch hashes only arr.tobytes(), so arrays with different shapes or dtypes can collide. Furthermore, non-tensor list inputs passed to hash_feature trigger a TypeError when passed to data_hash. An attacker with local system access and low privileges can exploit this by providing malicious multimodal inputs that hash to the same cache key, causing cache poisoning, incorrect embeddings, or service crashes. No patch has been released as of the advisory date; a pull request is pending acceptance.
Affected products
- sgl-project SGLang <= 0.5.11
Timeline
- 2026-05-16: disclosed: Bug reported in GitHub issue #25462
- 2026-06-04: advisory: GitHub Advisory Database published
- 2026-06-04: other: Fix pull request #22033 awaits acceptance