The vulnerability lies in the Cache Handler’s data_hash function in sgl-project SGLang. Improper handling of data_hash parameters allows an attacker to trigger a denial of service by exhausting or corrupting the cache. The weakness is classified as CWE‑404, representing an improper resource shutdown. The impact is a service interruption that can affect user experience and application availability.

All installations of sgl-project SGLang up to and including version 0.5.11 that utilize the Cache Handler are affected. The vulnerability is local‑execution only, meaning it can be triggered by a user who can run code on the host where SGLang is deployed.

The CVSS score is 2, indicating low severity, and the EPSS score is not available. The vulnerability is not listed in CISA KEV. Although the attack vector is restricted to local execution and requires a high level of complexity, the exploit has been publicly disclosed and can be used by local attackers, particularly those with elevated privileges. The risk is moderate, primarily due to the potential for a service outage in environments where SGLang provides critical functionality.