CVE-2026-111392— SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate
Quick assessment
Affected
sgl-project sglang
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SGLang（版本 0.5.21 及更早版本）将调用方提供的 值直接作为多模态前缀缓存的键，未进行充分验证，这使得远程攻击者能够污染跨请求的缓存键值（KV）条目。攻击者可通过 接口，利用已知或预测的哈希值提交不同的图像，从而窃取其他请求中的图像内容，或破坏受害者的响应结果。
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1070 · Indicator Removal T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| sgl-project | sglang | 0.5.13≤ 0.5.21 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111392
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate
Source: CVE Program / CVE List V5
Vulnerability Description
SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash via /generate to disclose another request's image content or corrupt victims' responses.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| sgl-project | sglang | 0.5.13 ~ 0.5.21 | - |
|
II. Public POCs for CVE-2026-111392
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111392
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-111392 (1)
IV. Related Vulnerabilities
Same product: sglang
-
CVE-2026-111391
SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper -
CVE-2026-110809
sgl-project SGLang Session Cleanup session_controller.py Ses -
CVE-2026-110807
sgl-project SGLang generate Endpoint io_struct.py denial of -
CVE-2026-109229
SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotro -
CVE-2026-109228
SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video
Same vendor: sgl-project
-
CVE-2026-111391
SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper -
CVE-2026-110809
sgl-project SGLang Session Cleanup session_controller.py Ses -
CVE-2026-110807
sgl-project SGLang generate Endpoint io_struct.py denial of -
CVE-2026-109229
SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotro -
CVE-2026-109228
SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video
Same weakness: CWE-345
-
CVE-2026-55103
Discourse ActivityPub: Fix inbound actor validation and appl -
CVE-2026-102682
Pipecat: Public exposure of Pipecat’s development runner can -
CVE-2026-102695
OmniFaces: Forged combined-resource IDs and related output/p -
CVE-2026-110607
BizSpring Shop through commit cf22d39daaf1 Payment Bypass vi -
CVE-2026-102250
TP-Link固件版本数据真实性校验绕过致设备控制权丢失
V. Comments for CVE-2026-111392
No comments yet