The vulnerability is present in SGLang’s Inference HTTP Endpoint, where manipulating the lora_path argument in python/sglang/srt/lora/lora_manager.py triggers a reachable assertion. The assertion failure causes the process to terminate, resulting in a denial of service. Classified as CWE-617, the flaw reveals a lack of proper boundary checking on a remotely controllable parameter, and the impact is a loss of availability for any clients depending on the inference API.

SGLang version 0.5.10.post1 is the only explicitly listed affected release. No other versions or vendors are mentioned in the CVE description. Users running this exact version are at risk until a patch is applied.

The CVSS score of 6.3 indicates moderate severity, while EPSS data is unavailable, and the vulnerability is not listed in CISA KEV. It can be exploited remotely with high complexity and is considered difficult to exploit, but the public disclosure and pending patch suggest that attackers could craft a malicious lora_path request to trigger the assertion and crash the endpoint. Exploitation requires no special conditions beyond sending a crafted request to the exposed inference API.