Executive brief
SGLang is a high-performance serving framework for large language models that can be deployed in a distributed configuration with separate prefill and decode engines. An unbounded memory allocation vulnerability in the decode engine allows attackers with access to internal communication channels to send a specially crafted message that causes the scheduler to allocate memory until the system runs out of resources, leading to service denial. This affects deployments that use prefill/decode disaggregation.
Technical details
The handle_staging_req() function in SGLang fails to validate the chunk_idx parameter from ZMQ STAGING_REQ frames, allowing an attacker to supply an arbitrarily large value that triggers unbounded memory allocation in the scheduler. The vulnerability requires network access to the decode engine's internal ZMQ rank port, which is typically only available in multi-node disaggregated deployment topologies. The attack causes denial of service by exhausting memory and forcing process termination.
Affected products
- SGLang Project SGLang through 0.5.20
Timeline
- 2026-09-18: disclosed