CVE-2026-102634: Sgl-Project Sglang

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstrap_room values to crash scheduler processes or hang other users' requests until transfer timeout.

Affected products

• Sgl-Project Sglang: up to and including 0.5.20

Published 2026-09-29. Last modified 2026-09-29.