CVE-2026-110809: SGLang Session Controller DoS Vulnerability

CVE-2026-110809 Overview

CVE-2026-110809 is a denial-of-service vulnerability in sgl-project SGLang versions up to and including 0.5.19. The flaw resides in the Session.create_req function within python/sglang/srt/session/session_controller.py, part of the Session Cleanup component. An authenticated remote attacker can manipulate session handling to crash the service. The weakness is classified as improper resource shutdown or release [CWE-404]. A public proof-of-concept exists, and a pull request fixing the issue is pending acceptance upstream.

Critical Impact

Remote attackers with low privileges can trigger a denial of service against SGLang inference servers by abusing session replacement logic in Session.create_req, disrupting availability of hosted large language model endpoints.

Affected Products

• sgl-project SGLang versions up to and including 0.5.19
• Component: Session Cleanup (python/sglang/srt/session/session_controller.py)
• Deployments exposing the SGLang runtime server over the network

Discovery Timeline

• 2026-10-15 - CVE-2026-110809 published to the National Vulnerability Database (NVD)
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-110809

Vulnerability Analysis

SGLang is a serving runtime for large language models. The vulnerable code path lives in the Session.create_req method of the session controller, which handles session creation and replacement during inference requests. When a client submits a crafted sequence of session requests, the cleanup logic for an existing session fails to release resources correctly, leading to a crash of the serving process.

Because SGLang often runs as a long-lived inference backend behind application APIs, a single successful request can terminate the service and interrupt in-flight generations for every tenant sharing the instance. The attack requires network reachability to the SGLang endpoint and low-privilege authenticated access, with no user interaction.

Root Cause

The root cause is improper resource shutdown or release [CWE-404] in the session replacement flow. When Session.create_req is invoked under conditions that trigger session replacement, cleanup of the previous session's state is not handled safely, producing an unhandled error that terminates the serving worker. See GitHub Issue #41470 for the maintainer discussion.

Attack Vector

The attack is network-based and remote. A client with valid credentials or access to the inference API submits a session-create request that forces the controller down the vulnerable replacement path. A public proof-of-concept script demonstrating the crash is available in a GitHub Gist PoC. No code execution or data disclosure results; impact is limited to availability of the SGLang service.

No verified code examples are available for inclusion. Refer to the linked PoC and upstream issue for reproduction details.

Detection Methods for CVE-2026-110809

Indicators of Compromise

• Unexpected termination or restart of the SGLang serving process shortly after a session-related API call
• Stack traces or exception logs referencing Session.create_req or session_controller.py
• Repeated session creation requests from a single client identity within a short time window
• Spikes in HTTP 5xx responses from the SGLang inference endpoint followed by worker restarts

Detection Strategies

• Instrument the SGLang runtime with structured logging to capture exceptions originating in python/sglang/srt/session/session_controller.py.
• Correlate crash events with upstream API gateway logs to identify the client identity and request payload that preceded the failure.
• Alert on anomalous session creation rates or repeated session replacement patterns per API key.

Monitoring Recommendations

• Monitor service uptime and worker restart counts for SGLang processes using the host's process supervisor or Kubernetes liveness metrics.
• Track request latency and error-rate deltas on inference endpoints to surface availability degradation early.
• Forward application logs to a centralized logging or SIEM system and build detections for crash signatures tied to the session controller.

How to Mitigate CVE-2026-110809

Immediate Actions Required

• Inventory all SGLang deployments and confirm whether they run version 0.5.19 or earlier.
• Restrict network exposure of SGLang inference endpoints to trusted clients using network ACLs, service meshes, or authenticated gateways.
• Enforce per-identity rate limits on session creation requests to reduce the blast radius of repeated exploitation attempts.
• Enable automatic process supervision so that worker crashes recover quickly while a patch is pending.

Patch Information

At the time of publication, the upstream fix is tracked in GitHub Pull Request #41483 and awaits acceptance. Operators should monitor the SGLang repository for a tagged release that incorporates the fix and upgrade promptly once available. Additional advisory context is available at VulDB CVE-2026-110809.

Workarounds

• Place SGLang behind an authenticated reverse proxy that validates and rate-limits session-create requests before they reach the runtime.
• Disable or restrict session replacement workflows if the application does not require them.
• Run SGLang workers under a supervisor configured for rapid restart to limit outage duration until the official patch is applied.

# Configuration example: apply simple per-client rate limiting at an NGINX reverse proxy
# in front of the SGLang inference endpoint to blunt repeated session-create abuse.
limit_req_zone $http_authorization zone=sglang_sessions:10m rate=5r/s;

server {
    listen 443 ssl;
    server_name sglang.internal.example.com;

    location /generate {
        limit_req zone=sglang_sessions burst=10 nodelay;
        proxy_pass http://sglang_backend;
    }
}