SGLang contains a denial‑of‑service vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decode worker. When an attacker sends a crafted message to the Decode control PULL socket, the worker thread terminates, halting the control loop and interrupting normal server operation. This permits any unauthenticated remote user who can reach the socket to incapacitate the target server, resulting in loss of availability for legitimate clients.

The affected product is SGLang from the vendor SGLang. The vulnerability exists in the component that handles AUX_DATA messages via ZeroMQ in the Decode worker. No specific version information is provided in the available data, but the issue applies to all releases of SGLang that include this component and expose the control socket to the network.

The vulnerability is exploitable remotely through the network if the Decode control PULL socket is reachable. The anticipated exploitation requires no authentication and can be performed from any endpoint that can connect to the socket, allowing an attacker to shut down the server. The EPSS score is not available, and the CVE is not listed in the CISA KEV catalog. The CVSS score is 5.9, indicating moderate risk. Nonetheless, the lack of input validation creates a moderate‑risk denial‑of‑service scenario that should be mitigated as soon as possible.