CVE-2026-112266

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.23

Description A denial of service issue exists where API clients can abort in-flight generation requests belonging to other users. This occurs when an attacker submits streaming requests to the '/generate' endpoint using a short, client-controlled rid (request identifier). By using single hex character rid values and then disconnecting, the attacker triggers prefix-matching abort logic that terminates all other active client requests.

Recommendations Update SGLang to version 0.5.23 or later. Avoid using short or single-character values for the rid parameter in the '/generate' endpoint.