CVE-2026-110807

Executive Summary

CVE-2026-110807 is a denial-of-service vulnerability in sgl-project SGLang, an open-source framework for large language model (LLM) serving, affecting versions up to and including 0.5.19. The flaw resides in the generate Endpoint component and is triggered by manipulating the session_params argument processed by code in python/sglang/srt/managers/io_struct.py. A remote, authenticated attacker can send a crafted request to degrade or exhaust service availability (CVSS 4.3, Low availability impact). The maintainers have not released a patch and have not responded to the reported issue.

Technical Analysis

SGLang is a high-performance serving framework for large language models, exposing HTTP generate endpoints that accept structured request payloads. According to the NVD description, the affected functionality is an unspecified routine within the file python/sglang/srt/managers/io_struct.py that handles the generate Endpoint. The vulnerability is classified as CWE-404 (Improper Resource Shutdown or Release), meaning the root cause is improper handling, cleanup, or release of a resource when the session_params argument is manipulated by an attacker.

Because resource lifecycle management is not correctly enforced, a crafted session_params value causes the affected code path to mishandle an associated resource. This produces a denial-of-service condition — the compute engine, request handler, or associated session object is left in an unrecoverable or resource-exhausted state. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) indicates the attack is network-reachable, requires low complexity, and requires the attacker to hold low privileges (consistent with a request to an exposed inference endpoint), with no confidentiality or integrity impact and a Low availability impact.

The exact malformed session_params structure and the precise resource that fails to be released are not disclosed in the available advisory text. The public issue report referenced by NVD does not provide a validated code-level root cause, and no patch diff exists to reverse-engineer. Analysts should therefore treat the mechanism as a resource-lifecycle/DoS flaw at the vulnerability-class level rather than assume specific internal call structures. Note that the description uses the terms generate Endpoint, session_params, and io_struct.py verbatim; no additional function or parameter names are confirmed.

Exploitation Scenarios

No public exploit code or Nuclei template is available. The following chain is inferred at the vulnerability-class level from the NVD description and CWE-404 classification; specific implementation details beyond those stated are not confirmed.

1. Reconnaissance / target identification: The attacker identifies an exposed SGLang inference server. SGLang deployments commonly expose an HTTP API over the network (frequently on default serving ports). Discovery is performed via internet-wide scanning (Shodan/Censys) or internal network enumeration.

2. Triggering the flaw class: The attacker issues a request to the generate Endpoint that supplies a crafted session_params argument. Because the resource-handling logic in python/sglang/srt/managers/io_struct.py does not properly release or validate the associated resource (CWE-404), the request drives the server into an improper resource state.

3. Payload / execution method: At the vulnerability-class level, the attack requires no authentication bypass and no code execution — it is a single crafted API request that manipulates session_params. Low privileges (PR:L) are assumed to be needed, consistent with an endpoint that requires some level of access or an authenticated session. No memory-corruption or injection primitive is involved.

4. Post-exploitation impact: Repeated or persistent submission of the crafted request produces a denial-of-service condition against the affected server or its session-handling subsystem. Given the Low availability subscore, the disruption may be partial or recoverable (e.g., degraded throughput, exhausted session resources, or a crashed worker), not necessarily full host compromise. Because the flaw is in the serving control path, cascading unavailability of downstream applications that depend on the LLM endpoint is plausible.

Impact Assessment

The impact is availability-focused. CVSS subscores: Availability = Low (A:L); Confidentiality and Integrity = None (C:N/I:N). The attack requires network access (AV:N), low complexity (AC:L), low privileges (PR:L), and no user interaction (UI:N), with scope unchanged (S:U). Business impact centers on disruption of LLM inference services that rely on SGLang — including internal AI assistants, API-backed model gateways, and downstream applications aggregating to a shared inference endpoint. Blast radius is bounded by the deployment architecture: a single affected node may degrade, but shared inference clusters fronting many applications can propagate the outage. No data exposure or tampering risk is indicated, so regulatory/confidentiality concerns are low; the primary risk is service downtime and resource exhaustion costs.

Detection Guidance

Sigma Rule

title: Potential SGLang generate Endpoint Denial of Service via session_params
id: 8f3c1a2e-1108-4b7c-9d21-2026sglangdos
status: experimental
description: Detects repeated or malformed requests to the SGLang generate endpoint abusing session_params that may cause resource exhaustion (CVE-2026-110807).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110807
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/generate'
  selection_params:
    cs-uri-query|contains: 'session_params'
  condition: selection_endpoint and selection_params
falsepositives:
  - Legitimate clients using session_params under normal load
level: medium

YARA Rule

rule CVE_2026_110807_SGLang_session_params_DoS
{
    meta:
        description = "Detects references to the SGLang generate endpoint session_params abuse (CVE-2026-110807)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110807"
        date = "2026-01-01"
    strings:
        $ep = "/generate" ascii wide nocase
        $sp = "session_params" ascii wide nocase
        $io = "io_struct.py" ascii wide nocase
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110807 SGLang generate endpoint session_params DoS attempt"; flow:established,to_server; http.uri; content:"/generate"; http.uri; content:"session_params"; classtype:attempted-dos; reference:cve,2026-110807; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110807; sid:2026110807; rev:1;)

Elastic Detection

http where http.request.method in ("POST", "GET") and
  stringContains(http.request.uri, "/generate") and
  stringContains(http.request.uri, "session_params")

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri, url, cs_uri_stem)
| where like(uri, "%/generate%") AND like(uri, "%session_params%")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, status
| where count > 20
| sort - count

Wazuh OSSEC Rule

<group name="web,cve-2026-110807,">
  <rule id="1108070" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <url>/generate</url>
    <match>session_params</match>
    <description>CVE-2026-110807: SGLang generate endpoint session_params DoS attempt detected</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Restrict network exposure of the SGLang generate Endpoint to trusted clients only (network ACLs, VPN, or a reverse proxy with authentication and rate limiting).
• Apply per-client rate limiting and request-size limits on the session_params argument at the gateway/proxy layer to blunt resource exhaustion.
• Deploy the Suricata/Sigma/Wazuh detections above to identify and throttle repeating malformed requests.
• Monitor for abnormal accumulation of session resources and restart affected workers when resource exhaustion is observed.

2. Patch/upgrade steps:

• No vendor patch is available and the maintainers have not responded to the issue. Track the sgl-project SGLang repository for a fix; upgrade to the first release that addresses io_struct.py session_params resource handling once published. Verify against the project's release notes rather than assuming a version is fixed.

3. Long-term hardening:

• Enforce strict validation and lifecycle management of session_params and session-scoped resources in the request handling path (addressing the underlying CWE-404 weakness).
• Isolate the inference service in a segmented network zone and adopt defense-in-depth around model serving endpoints.
• Add resource quotas, request timeouts, and circuit breakers so a single tenant cannot exhaust shared inference capacity.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110807
• SGLang project repository (sgl-project/SGLang): https://github.com/sgl-project/sglang
• CWE-404: Improper Resource Shutdown or Release — https://cwe.mitre.org/data/definitions/404.html
• CISA KEV Catalog (no entry for this CVE as of reporting): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• No known threat actor campaigns or confirmed exploit-in-the-wild activity identified; NVD notes a public exploit is available but no PoC code is present in tracked sources.