CVE-2026-112266

{
  "etk_id": "ETK-2026-2059",
  "cve_id": "CVE-2026-112266",
  "display_id": "CVE-2026-112266",
  "ghsa_id": "GHSA-8v54-r9x8-p94v",
  "euvd_id": "EUVD-2026-104307",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cross-request denial of service in SGLang",
  "summary": "SGLang through 0.5.22 can allow one API client to cancel generation work belonging to other clients. Exploitation requires access to the generation API and relies on supplying a short client-selected request identifier before disconnecting.",
  "mitigation": "Restrict generation API access to authenticated, trusted clients and isolate tenants where possible. Until an upstream fixed release is available, monitor for abnormal request cancellations and limit exposure of the service to untrusted networks.",
  "vendor": "sgl-project",
  "product": "SGLang",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 0.5.22"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "sglang",
      "purl": null
    }
  ],
  "cwes": [
    187
  ],
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0042,
  "epss_percentile": 0.3512,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 104.47063595,
  "t0_at": "2026-10-19T13:55:15.822000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-19T13:55:15.822000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T13:55:15.822000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112266"
    }
  }
}