CVE-2026-112082

sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service

View on CVE.org

Published Oct 19, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

sgl-project

SGLang

affected

Version	Status	Constraints
`0.5.0`	affected	—
`0.5.1`	affected	—
`0.5.2`	affected	—
`0.5.3`	affected	—
`0.5.4`	affected	—
`0.5.5`	affected	—
`0.5.6`	affected	—
`0.5.7`	affected	—
`0.5.8`	affected	—
`0.5.9`	affected	—
`0.5.10`	affected	—
`0.5.11`	affected	—
`0.5.12`	affected	—
`0.5.13`	affected	—
`0.5.14`	affected	—
`0.5.15`	affected	—
`0.5.16`	affected	—
`0.5.17`	affected	—
`0.5.18`	affected	—
`0.5.19`	affected	—

No data.

Vendor Product Versions

Sgl-project

Sglang

Version	Status	Scheme	Platform
`0.5.0`	affected	semver	—
`0.5.1`	affected	semver	—
`0.5.2`	affected	semver	—
`0.5.3`	affected	semver	—
`0.5.4`	affected	semver	—
`0.5.5`	affected	semver	—
`0.5.6`	affected	semver	—
`0.5.7`	affected	semver	—
`0.5.8`	affected	semver	—
`0.5.9`	affected	semver	—
`0.5.10`	affected	semver	—
`0.5.11`	affected	semver	—
`0.5.12`	affected	semver	—
`0.5.13`	affected	semver	—
`0.5.14`	affected	semver	—
`0.5.15`	affected	semver	—
`0.5.16`	affected	semver	—
`0.5.17`	affected	semver	—
`0.5.18`	affected	semver	—
`0.5.19`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Complete

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.626% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/sgl-project/sglang/
https://github.com/sgl-project/sglang/issues/42071
https://github.com/sgl-project/sglang/pull/42098
https://vuldb.com/cve/CVE-2026-112082
https://vuldb.com/submit/1009918
https://vuldb.com/vuln/421761
https://vuldb.com/vuln/421761/cti

History

Oct 19, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 19, 2026 5:45 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
Title		sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service
First Time appeared		Sgl-project Sgl-project sglang
Weaknesses		CWE-404
CPEs		cpe:2.3:a:sgl-project:sglang::::::::
Vendors & Products		Sgl-project Sgl-project sglang
References		https://github.com/sgl-project/sglang/ https://github.com/sgl-project/sglang/issues/42071 https://github.com/sgl-project/sglang/pull/42098 https://vuldb.com/cve/CVE-2026-112082 https://vuldb.com/submit/1009918 https://vuldb.com/vuln/421761 https://vuldb.com/vuln/421761/cti
Metrics		cvssV2_0 `{'score': 7.8, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:C/E:POC/RL:ND/RC:C'}` cvssV3_0 `{'score': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:C'}` cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:C'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P'}`