SGLang versions through 0.5.22 contain an uncontrolled memory allocation bug in the handle_staging_rsp() routine of the Mooncake disaggregation backend. An attacker need only be network‑adjacent and unauthenticated; by first querying the /route endpoint to obtain a rank address, the attacker can then send STAGING_RSP messages that contain overly large chunk_idx values under new room identifiers. The scheduler threads performing the allocation will grow to consume all prefilling memory and are eventually killed by the operating system, causing a service outage.

The vulnerability affects any deployment of the sgl-project:sglang package at or below version 0.5.22, specifically when the Mooncake disaggregation backend is enabled. No other versions or products are listed as affected.

The CVSS score of 7.1 labels the flaw as high‑severity, and while no EPSS score is currently available a lack of a KEV listing does not reduce the likelihood of exploitation. Because the attack requires only network adjacency and no authentication, an adversary with access to the same local network segment can trigger an out‑of‑memory condition and cause a denial of service. The risk is therefore significant for exposed deployments, though it is limited to environments where the disaggregation backend is reachable from unauthenticated clients.