Is CVE-2026-112266 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112266 being exploited in the wild.

How severe is CVE-2026-112266?

Medium severity, with a CVSS score of 5.9, published 19 October 2026.

Is there a fix for CVE-2026-112266?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-112266 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-112266?

Check whether you run SGLang at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112266: SGLang denial of service via request ID prefix matching

CVE-2026-112266 · Severity: medium · CVSS 5.9 · Published 2026-10-19

SGLang is a language model serving framework that handles API requests for text generation. A vulnerability in versions through 0.5.22 allows an attacker to disrupt the service for other users by submitting crafted requests with short identifiers, causing all in-flight generation requests to be aborted. This results in service denial and loss of work for legitimate users.

Technologies: SGLang. Vendors: SGLang.

Quick answers

Is CVE-2026-112266 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112266 being exploited in the wild.
How severe is CVE-2026-112266?: Medium severity, with a CVSS score of 5.9, published 19 October 2026.
Which products and versions are affected?: SGLang through 0.5.22.
Is there a fix for CVE-2026-112266?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112266 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-112266?: Check whether you run SGLang at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the request abort logic within SGLang's scheduler, which uses prefix-matching on client-supplied request IDs (rid) instead of exact matching. An attacker can submit a streaming /generate request with a single hex character rid and immediately disconnect, triggering the prefix-match logic to terminate all other clients' requests whose IDs share that prefix. This requires network access to the API endpoint but no authentication or special privileges.

Affected products

SGLang SGLang through 0.5.22

Timeline

2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.