CVE-2026-93688— SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room
Quick assessment
Affected
sgl-project sglang
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine's POST /generate endpoint
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93688
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room
Source: CVE Program / CVE List V5
Vulnerability Description
SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine's POST /generate endpoint and submit arbitrary bootstrap_room values to exhaust prefill process memory until out-of-memory termination.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| sgl-project | sglang | 0 ~ 0.5.19 | - |
|
II. Public POCs for CVE-2026-93688
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93688
请登录查看更多情报信息。
Other References for CVE-2026-93688 (3)
IV. Related Vulnerabilities
Same weakness: CWE-770
-
CVE-2026-64847
AnyIO process-pool workers can block indefinitely on undrain -
CVE-2026-91149
Cockpit: cockpit: denial of service via unbounded connection -
CVE-2026-84447
libheif: Derived-image indirect reference chains and tiled o -
CVE-2026-10832
Org.wildfly.security/wildfly-elytron-asn1: unbounded memory -
CVE-2026-93491
Io.netty/netty-codec-http: netty: denial of service via unbo
V. Comments for CVE-2026-93688
No comments yet