CVE-2026-110809: sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-15 · updated 2026-10-15
Weakness: CWE-404

Description

A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.create_req of the file python/sglang/srt/session/session_controller.py of the component Session Cleanup. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.

Affected products

SGLang: 0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5 (+14)

References

https://gist.github.com/Yunzez/dbd254603fa2bc74358cb3647423d0ec#file-repro_sglang_session_replace_crash-py
https://github.com/sgl-project/sglang/
https://github.com/sgl-project/sglang/issues/41470
https://github.com/sgl-project/sglang/pull/41483
https://vuldb.com/cve/CVE-2026-110809
https://vuldb.com/submit/1004356
https://vuldb.com/vuln/420279
https://vuldb.com/vuln/420279/cti

Get alerted when CVE-2026-110809 or the next vulnerability affects your stack