CVE-2026-112083

Name of the Vulnerable Software and Affected Versions sgl-project SGLang versions prior to 0.5.20

Description A flaw in the Weight Exporter component allows a remote attacker to cause a denial of service. This occurs through the manipulation of the group name argument within the WeightExporter.send weights to remote instance() function located in the python/sglang/srt/model executor/model runner components/weight exporter.py file.

Recommendations As a temporary workaround, restrict access to the WeightExporter.send weights to remote instance() function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.