Description
A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
Published: 2026-10-19
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the Scheduler.expert_distribution_handle function within the Expert‑Distribution Recording Endpoint (expert_distribution.py) of the sgl‑project SGLang project. Manipulation of the function can trigger a denial of service, causing the system to become unresponsive or terminate processes.

Affected Systems

Vendors: sgl‑project; Product: SGLang. All releases up to and including version 0.5.19 are affected. No later releases have been confirmed to contain the flaw.

Risk and Exploitability

With a CVSS score of 8.7, the flaw is considered high severity. The EPSS score is not available, and the vulnerability is not yet listed in CISA KEV. The description indicates the attack can be launched remotely and the exploit is publicly available, implying that an external attacker could repeatedly trigger service loss without needing special permissions.

Generated by OpenCVE AI on October 19, 2026 at 06:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the fix from the pending pull request (PR 42098) once it is merged and released in a new SGLang version.
  • If an update is not immediately available, restrict external access to the Expert‑Distribution Recording Endpoint via firewall rules or network segmentation to limit the attack surface.
  • If the endpoint is not required for your deployment, disable or remove the expert_distribution module to eliminate exposure.

Generated by OpenCVE AI on October 19, 2026 at 06:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 05:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
Title sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service
First Time appeared Sgl-project
Sgl-project sglang
Weaknesses CWE-404
CPEs cpe:2.3:a:sgl-project:sglang:*:*:*:*:*:*:*:*
Vendors & Products Sgl-project
Sgl-project sglang
References
Metrics cvssV2_0

{'score': 7.8, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:C/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sgl-project Sglang
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-19T05:30:22.073Z

Reserved: 2026-10-18T14:24:29.762Z

Link: CVE-2026-112082

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-19T06:17:23.013

Modified: 2026-10-19T06:17:23.293

Link: CVE-2026-112082

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T06:30:06Z

Weaknesses
  • CWE-404

    Improper Resource Shutdown or Release