The vulnerability resides in the Session.create_req function within the Session Cleanup component of SGLang. It can cause a denial of service when an attacker manipulates a session request, allowing remote attackers to trigger a crash or hang that disrupts service availability. This flaw is identified as CWE-404, indicating an unauthorized resource removal or failure.

The affected product is the SGLang language framework from sgl-project. All releases up to and including version 0.5.19 are vulnerable. The CVE impacts the session_controller.py module in the python/sglang/srt/session directory, but the exact affected versions are those prior to the fix in later releases.

The CVSS score of 5.3 indicates a medium severity impact. The EPSS score is not available, and the vulnerability is not yet listed in CISA's KEV catalog. The public disclosure and available exploit code mean that remote attackers can take advantage of this flaw. Since the issue arises from manipulation of session creation requests, attackers can execute the exploit from outside the network environment without elevated privileges. The risk remains moderate but realistic for exposed services.