CVE-2026-93838

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.20

Description An unbounded memory allocation issue exists in the handle staging req() function within prefill/decode disaggregation deployments. The system fails to validate the chunk idx variable received from ZMQ STAGING REQ frames. An attacker with access to the internal ZMQ rank port of the decode engine can send a frame containing an excessively large chunk idx value, leading the scheduler to allocate memory until system resources are exhausted and the process terminates.

Recommendations Update to version 0.5.20 or later.