CVE-2026-93838: Sgl-Project Sglang

Medium severity, CVSS 5.9. EPSS: 0.7% chance of exploitation in the next 30 days.

SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefill/decode disaggregation deployments. Attackers with access to the decode engine's internal ZMQ rank port can send a frame with an extremely large chunk_idx value, causing the scheduler to allocate memory until the system runs out and terminates the process.

Affected products

• Sgl-Project Sglang: up to and including 0.5.20

Published 2026-09-18. Last modified 2026-09-22.