CVE-2026-102634 — SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room
SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenti…
Published: 2026-09-29 · CVSS: 8.7 · CVSS 4.0
SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstrap_room values to crash scheduler processes or hang other users' requests until transfer timeout.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7