CVE-2026-110809— sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service
Quick assessment
Affected
sgl-project SGLang
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 sgl-project SGLang（最高至 0.5.19 版本）中发现了一个安全漏洞。该漏洞影响组件“Session Cleanup”中的文件 的 函数。此类操纵可导致拒绝服务（DoS）攻击。攻击者可从远程执行此攻击。该漏洞已被公开披露，且可能被利用。目前修复该问题的拉取请求（Pull Request）仍在等待审核接受。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1499 · Endpoint Denial of ServiceAffected Version Matrix 20
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| sgl-project | SGLang | 0.5.0 |
affected |
0.5.1 |
affected | ||
0.5.2 |
affected | ||
0.5.3 |
affected | ||
0.5.4 |
affected | ||
0.5.5 |
affected | ||
0.5.6 |
affected | ||
0.5.7 |
affected | ||
| … +12 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110809
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service
Source: CVE Program / CVE List V5
Vulnerability Description
A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.create_req of the file python/sglang/srt/session/session_controller.py of the component Session Cleanup. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不恰当的资源关闭或释放
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| sgl-project | SGLang | 0.5.0 |
cpe:2.3:a:sgl-project:sglang:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-110809
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110809
请登录查看更多情报信息。
Other References for CVE-2026-110809 (1)
IV. Related Vulnerabilities
Same product: SGLang
-
CVE-2026-111392
SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /g -
CVE-2026-111391
SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper -
CVE-2026-110807
sgl-project SGLang generate Endpoint io_struct.py denial of -
CVE-2026-109229
SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotro -
CVE-2026-109228
SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video
Same vendor: sgl-project
-
CVE-2026-111392
SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /g -
CVE-2026-111391
SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper -
CVE-2026-110807
sgl-project SGLang generate Endpoint io_struct.py denial of -
CVE-2026-109229
SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotro -
CVE-2026-109228
SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video
Same weakness: CWE-404
-
CVE-2026-110807
sgl-project SGLang generate Endpoint io_struct.py denial of -
CVE-2026-49785
UEFI Secure Boot Security Feature Bypass Vulnerability -
CVE-2026-109277
ImageMagick before 7.1.2-32 Policy Bypass via -script Operat -
CVE-2026-108769
zhayujie CowAgent Markdown Rendering Markdown.tsx denial of -
CVE-2026-108682
zhayujie CowAgent Web Console upload read denial of service
V. Comments for CVE-2026-110809
No comments yet