CVE-2026-112269

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.23

Description SGLang with the Mooncake disaggregation backend allows denial of service when it accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket. Network-adjacent attackers can exhaust Prefill memory, leading to the scheduler being OOM-killed (Out-Of-Memory killed, a process where the operating system terminates a process to free up memory), by sending numerous registrations containing large nested-buffer frames and unique mooncake session id values.

Recommendations Update SGLang to version 0.5.23 or later.