CVE-2026-110809

Executive Summary

CVE-2026-110809 is a denial-of-service vulnerability in sgl-project SGLang (versions up to and including 0.5.19), located in the Session.create_req function of python/sglang/srt/session/session_controller.py, within the Session Cleanup component. Improper resource handling (CWE-404) allows a remote, authenticated actor to disrupt service availability. Impact is limited to availability (CVSS 4.3, AV:L-adjacent low availability impact); no confidentiality or integrity loss is expected. No patch has been accepted upstream and no public PoC or exploit code is currently tracked.

Technical Analysis

SGLang is a high-performance serving framework for large language models (LLMs), commonly deployed behind inference APIs. The affected code resides in the session controller module (python/sglang/srt/session/session_controller.py), which manages lifecycle operations for inference sessions. The vulnerability is classified as CWE-404 (Improper Resource Shutdown or Release) and is reachable via the Session.create_req function.

According to the NVD description, "Such manipulation leads to denial of service." The flaw sits within the "Session Cleanup" component, indicating that improper handling of resources during session creation or cleanup can be induced by a remote caller. Because the CVSS vector specifies AV:N (network), AC:L (low complexity), and PR:L (low privileges), exploitation requires only network reachability and a low-privilege position — for example, an authenticated API caller or a user with access to an exposed inference endpoint.

The precise code-level mechanism (e.g., whether an unbounded session allocation, a missing release path, or a race during cleanup is responsible) is not fully specified in the available data. The NVD entry references a public disclosure and an outstanding upstream pull request but provides no CVE description of the exact faulty code path beyond the named function and file. Analysts should therefore treat the attack surface as the session management API of SGLang, where repeated or malformed session creation requests can exhaust resources and induce service degradation or crash. Per the CVSS subscores (C:N/I:N/A:L), the resulting impact is a low-severity availability degradation rather than a total outage, consistent with resource exhaustion affecting a subset of sessions or a worker process.

No affected version list, patch source, or vendor fix reference was returned by tracked sources, and the affected package entry is recorded as unfixed.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred at the vulnerability-class level from the NVD description and CWE-404 classification. Specific payloads, parameter names, or request schemas are not disclosed and must not be assumed.

1. Reconnaissance / target identification. An adversary identifies an exposed SGLang inference service (e.g., a reachable HTTP inference endpoint) running version 0.5.19 or earlier. Shodan/HTTP fingerprinting of SGLang banners or landing pages can identify candidate targets. No authentication bypass is required beyond the low-privilege access assumed by the CVSS vector.

2. Triggering the flaw class. The attacker issues session-creation requests that exercise Session.create_req in session_controller.py. Because the component is responsible for cleanup, the attacker induces improper resource release or repeated resource allocation — for example, by generating sessions whose cleanup path is not properly completed. The attacker does not need to bypass authentication; PR:L indicates a low-privileged position suffices.

3. Execution method (class level). This is a resource-exhaustion / improper-shutdown attack (CWE-404) rather than code execution or injection. The attacker repeatedly drives the session management surface to deplete or corrupt the resources that the cleanup logic is supposed to reclaim. No memory-corruption or RCE technique is implied by the data.

4. Post-exploitation impact. Successful exploitation results in denial of service — degraded or unavailable model inference for legitimate users. Per A:L, the availability impact is limited; the outcome is service disruption rather than full compromise. There is no evidence of data exfiltration, lateral movement, or persistent access.

Because the upstream fix awaits acceptance and no exploit is publicly tracked, this vulnerability currently presents a low, opportunistic denial-of-service risk rather than an active exploitation campaign.

Impact Assessment

The CVSS v3.1 base score is 4.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. Interpretation:

• AV:N — exploitable over the network, so any internet- or intranet-reachable SGLang endpoint is in scope.
• AC:L — no special conditions; attacks are straightforward and repeatable.
• PR:L — low privileges required; an authenticated or low-tier API consumer can trigger it.
• UI:N — no user interaction.
• S:U — impact is confined to the vulnerable component.
• C:N / I:N / A:L — no confidentiality or integrity impact; limited availability impact.

Blast radius. Affected systems are SGLang deployments at version 0.5.19 or earlier that expose the session controller to remote callers. In multi-tenant LLM serving environments, one low-privileged tenant could degrade service for other tenants sharing the same backend. Business impact centers on degraded inference throughput, potential worker restarts, and SLA erosion for AI/ML services. Given A:L, full platform-wide outage is unlikely, but repeated exploitation could accumulate into sustained unavailability.

EPSS is 0.00324 (23.8th percentile), indicating a low probability of exploitation in the near term, consistent with the absence of public exploit code. The CVE is not listed in CISA KEV.

Detection Guidance

Because no exploit code exists, detections below target anomalous session-creation/cleanup behavior and resource-exhaustion patterns against SGLang session endpoints. Field names and paths reflect only what is disclosed.

Sigma Rule

title: SGLang Session Controller Denial of Service Attempt (CVE-2026-110809)
id: 3f9c2a71-8b4e-4d2a-9c1e-sglang110809
status: experimental
description: Detects abnormal repeated session creation activity against SGLang session controller, indicating potential CWE-404 resource-exhaustion DoS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110809
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: sglang
  service: session
detection:
  selection_path:
    request_path|contains:
      - '/session'
      - 'create_req'
  selection_volume:
    status: 'success'
  timeframe: 60s
  condition: selection_path | count(selection_volume) > 100
fields:
  - client_ip
  - request_path
  - user
falsepositives:
  - Legitimate high-volume batch inference clients
level: medium

YARA Rule

rule CVE_2026_110809_SGLang_Session_DoS
{
    meta:
        description = "Detects references to the vulnerable SGLang session controller component"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110809"
        cve = "CVE-2026-110809"
        date = "2026-01-01"
    strings:
        $f1 = "session_controller.py" ascii
        $f2 = "session/session_controller" ascii
        $f3 = "def create_req" ascii
        $f4 = "Session.create_req" ascii
    condition:
        any of ($f*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110809 SGLang Session Controller DoS Attempt"; flow:to_server,established; http.uri; content:"/session"; http.method; content:"POST"; threshold:type both, track by_src, count 100, seconds 60; classtype:attempted-dos; reference:cve,2026-110809; sid:11080901; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ http where http.request.method == "POST" and url.path : "/session" ]
  [ http where http.request.method == "POST" and url.path : "/session" ]
  [ http where http.request.method == "POST" and url.path : "/session" ]

Splunk SPL Query

index=web OR index=proxy
| search uri_path="/session" http_method=POST
| bucket _time span=1m
| stats count as req_count dc(clientip) as unique_clients by _time, clientip, uri_path
| where req_count > 100
| sort - req_count

Wazuh OSSEC Rule

<group name="sglang,web,attack,">
  <rule id="110809" level="10" frequency="100" timeframe="60">
    <if_matched_sid>31100</if_matched_sid>
    <match>session</match>
    <description>CVE-2026-110809: Possible SGLang session controller denial-of-service (resource exhaustion)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>dos,availability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No accepted upstream fix currently exists; the referenced pull request awaits acceptance, and the tracked package version is recorded as unfixed.

1. Immediate mitigations

   • Restrict network exposure of SGLang inference and session endpoints to trusted networks; enforce authentication and least privilege so that low-privileged clients (PR:L) cannot freely drive session creation.
   • Apply rate limiting and request quotas on session-creation paths at the reverse proxy or API gateway.
   • Monitor for abnormal session-creation volume and resource (memory/thread/handle) growth; restart the SGLang service if exhaustion is observed.

2. Patch / upgrade steps

   • Track the upstream sgl-project SGLang repository and apply the pending fix to python/sglang/srt/session/session_controller.py once the pull request is accepted and released.
   • Upgrade to the first fixed release once published; no fixed version is confirmed at this time.

3. Long-term hardening

   • Implement request-level timeouts and bounded session pools to limit the blast radius of improper-resource-release conditions.
   • Deploy resource-exhaustion and process-health monitoring for inference workers.
   • Review session lifecycle code for other CWE-404 patterns and add regression tests around session creation/cleanup.

References

• NVD — CVE-2026-110809: https://nvd.nist.gov/vuln/detail/CVE-2026-110809
• sgl-project / SGLang upstream repository (session controller code path): https://github.com/sgl-project/sglang
• CWE-404 — Improper Resource Shutdown or Release: https://cwe.mitre.org/data/definitions/404.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS — CVE-2026-110809 scoring: https://api.first.org/data/v1/epss?cve=CVE-2026-110809

Threat actor campaigns: None known. No public exploit, no CISA KEV listing, and no in-the-wild exploitation evidence is associated with this CVE at this time.