CVE-2026-102634

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.21

Description When operating in prefill/decode disaggregation mode with the Mooncake KV transfer backend, the software fails to validate duplicate bootstrap room fields in the '/generate' endpoint. Unauthenticated attackers can send concurrent requests using identical bootstrap room values, which can lead to the crashing of scheduler processes or cause other users' requests to hang until a transfer timeout occurs.

Recommendations Update SGLang to version 0.5.21 or later.