# CVE-2026-112267: SGLang server-side request forgery in prefill/decode disaggregation

Source: https://junglewise.ai/threats/cve-2026-112267-sglang-through-0-5-22-in-prefill-decode-disaggregation-mode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-112267 · Severity: medium · CVSS 6.5 · Published 2026-10-19

SGLang is an open-source serving framework for large language models that supports disaggregated prefill and decode workloads. An unauthenticated attacker can send crafted requests containing bootstrap host and port information to the Decode worker, forcing it to make outbound connections to arbitrary internal systems. This can be used to map internal networks, block inference requests, and potentially access sensitive services running on internal hosts.

Technologies: [SGLang Project SGLang](https://junglewise.ai/threats/technologies/sglang). Vendors: [SGLang Project](https://junglewise.ai/threats/vendors/sglang-project).

## Quick answers

**Is CVE-2026-112267 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112267 being exploited in the wild.

**How severe is CVE-2026-112267?** Medium severity, with a CVSS score of 6.5, published 19 October 2026.

**Which products and versions are affected?** SGLang Project SGLang through 0.5.22.

**Is there a fix for CVE-2026-112267?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-112267 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-112267?** Check whether you run SGLang Project SGLang at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a server-side request forgery (SSRF) in SGLang's prefill/decode disaggregation mode, where client-supplied bootstrap_host and bootstrap_port parameters in requests to the Decode worker's /generate endpoint are not properly validated before use in outbound connections. An unauthenticated attacker can exploit this to probe internal hosts and ports or block the shared scheduler loop, delaying other inference requests. No authentication is required, and the attack vector is network-based.

## Affected products

- SGLang Project SGLang through 0.5.22

## Timeline

- 2026-10-19: disclosed

## References

- [https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/disaggregation/common/conn.py](https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/disaggregation/common/conn.py)
- [https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/disaggregation/decode.py](https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/disaggregation/decode.py)

## Related threats

- [SGLang uncontrolled memory allocation in Mooncake disaggregation backend](https://junglewise.ai/threats/cve-2026-112270-sglang-through-0-5-22-with-the-mooncake-disaggregation-backend)
- [SGLang Mooncake disaggregation backend unauthenticated denial of service](https://junglewise.ai/threats/cve-2026-112269-sglang-through-0-5-22-with-the-mooncake-disaggregation-backend)
- [SGLang cache poisoning via untrusted mm_hashes in multimodal prefix cache](https://junglewise.ai/threats/cve-2026-111392-sglang-through-0-5-21-trusts-caller-supplied-mm-hashes-values-as)
- [SGLang code injection in _evaluate_filter()](https://junglewise.ai/threats/cve-2026-111391-sglang-0-5-10-through-0-5-22-contains-a-code-injection)
- [SGLang denial of service via disabled image decompression protection](https://junglewise.ai/threats/cve-2026-109229-sglang-through-0-5-21-contains-a-denial-of-service-vulnerability)