CVE-2026-93838 — SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx
SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefi…
Published: 2026-09-18 · CVSS: 8.2 · CVSS 4.0
SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefill/decode disaggregation deployments. Attackers with access to the decode engine's internal ZMQ rank port can send a frame with an extremely large chunk_idx value, causing the scheduler to allocate memory until the system runs out and terminates the process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7