Executive brief
SGLang is a serving framework for large language models that can be deployed in a disaggregated architecture where prefill and decode processing are separated. An unauthenticated attacker can send specially crafted requests to the decode engine that cause unbounded memory allocation in the prefill process, eventually exhausting all available memory and causing the service to crash.
Technical details
The vulnerability exists in prefill/decode disaggregation mode when using the Mooncake KV transfer backend. The POST /generate endpoint accessible on the decode engine fails to validate bootstrap_room parameter values, allowing attackers to trigger arbitrary memory allocation on the prefill engine via the KV transfer mechanism. This is a denial-of-service condition that terminates the prefill process due to out-of-memory conditions.
Affected products
- SGLang Project SGLang through 0.5.19
Timeline
- 2026-09-18: disclosed