SGLang up to version 0.5.22 contains a server‑side request forgery flaw triggered by the unvalidated bootstrap_host and bootstrap_port fields in the Decode worker /generate endpoint. No authentication is required, allowing an attacker to send crafted requests that cause the worker to issue outbound HTTP connections to arbitrary hosts and ports. This can be employed to probe internal resources and, by blocking the shared scheduler loop, induce denial‑of‑service conditions for other inference jobs.

sglang, the project from sgl‑project, version 0.5.22 and earlier. Any deployment that relies on these versions inherits the SSRF vulnerability in the prefill/decode disaggregation mode of the Decode worker component.

The CVSS score of 6.9 indicates medium severity, but EPSS data is not available, so the exploitation probability remains unknown. The flaw is not listed in CISA KEV. Attackers can exploit the vulnerability by targeting the /generate endpoint with crafted bootstrap_host/port parameters, which are client‑supplied and unprotected. Successful exploitation permits internal host discovery and potential service disruption of inference traffic. Mitigation requires limiting outbound connections or updating the library.