CVE-2026-93688: SGLang Mooncake Backend DoS Vulnerability

CVE-2026-93688 Overview

CVE-2026-93688 affects SGLang through version 0.5.19 when running in prefill/decode disaggregation mode with the Mooncake KV transfer backend. The server fails to validate bootstrap_room values submitted to the decode engine's POST /generate endpoint. Unauthenticated remote attackers can submit arbitrary bootstrap_room values to trigger unbounded transfer state allocation. Sustained requests exhaust the prefill process memory until out-of-memory (OOM) termination. This is a resource exhaustion issue tracked under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
Unauthenticated attackers with network access to the decode engine can crash SGLang inference workers by exhausting memory, disrupting AI inference services running in disaggregated mode.

Affected Products

SGLang through version 0.5.19
SGLang deployments using prefill/decode disaggregation mode
SGLang deployments configured with the Mooncake KV transfer backend

Discovery Timeline

2026-09-18 - CVE-2026-93688 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93688

Vulnerability Analysis

SGLang is a serving framework for large language models. In disaggregated deployments, prefill and decode stages run in separate processes and exchange key-value (KV) cache data using a transfer backend such as Mooncake. Each transfer is keyed by a bootstrap_room identifier that ties a decode request to its prefill state.

The decode engine exposes POST /generate and accepts bootstrap_room values from clients without validation. The server allocates a transfer state entry for every new value it observes. Because there is no upper bound on the number of tracked rooms and no authentication on the endpoint, an attacker can flood the service with unique identifiers. The prefill process consumes memory for each entry until the operating system terminates it.

The defect is a classic missing resource limit. It maps to CWE-770 and results in a denial-of-service condition against inference workers.

Root Cause

The scheduler and Mooncake connection handler accept caller-supplied bootstrap_room values and register them in internal transfer state maps without size caps, per-client quotas, or authentication. Relevant code paths are documented in the SGLang Mooncake connection module, the transfer state allocation, the I/O struct definition, and the scheduler handler.

Attack Vector

Exploitation requires only network reachability to the decode engine's HTTP endpoint. The attacker issues repeated POST /generate requests with distinct bootstrap_room values. Each request causes the prefill worker to allocate additional transfer state, and memory usage grows without bound until the process is killed. No credentials, user interaction, or knowledge of internal state is required. See the VulnCheck advisory and SGLang issue #39428 for additional detail.

No verified public proof-of-concept code has been published. See the referenced advisories and source lines above for technical details.

Detection Methods for CVE-2026-93688

Indicators of Compromise

Rapid memory growth in SGLang prefill worker processes without corresponding legitimate request volume.
Repeated POST /generate requests carrying unique or randomized bootstrap_room values from a single source or small set of sources.
OOM-killer events in system logs terminating SGLang prefill or decode processes.
Elevated open transfer-state counts in Mooncake KV backend metrics with no matching completed transfers.

Detection Strategies

Instrument the decode engine to log bootstrap_room value cardinality per source IP over sliding windows.
Alert on divergence between allocated transfer states and completed KV transfers over time.
Correlate spikes in SGLang process resident memory with request rate on /generate and flag anomalies.

Monitoring Recommendations

Monitor container and host memory pressure metrics for pods running SGLang in disaggregated mode.
Track HTTP request rates and unique bootstrap_room counts at the ingress or API gateway layer.
Forward SGLang application logs and Linux dmesg OOM events to a centralized logging pipeline for correlation.

How to Mitigate CVE-2026-93688

Immediate Actions Required

Restrict network access to the SGLang decode engine's /generate endpoint to trusted clients using firewall rules or a service mesh policy.
Place an authenticating reverse proxy or API gateway in front of the decode engine and reject unauthenticated requests.
Apply per-source rate limits on POST /generate and cap concurrent in-flight requests.
Configure container memory limits and automated restart policies to contain the blast radius of an OOM event.

Patch Information

No fixed version is identified in the referenced advisories at the time of publication. Monitor the SGLang repository and issue #39428 for a release addressing bootstrap_room validation and transfer-state bounding. Upgrade beyond version 0.5.19 once a patched release is available.

Workarounds

Disable prefill/decode disaggregation mode where feasible until a patch is available.
Terminate TLS and enforce authentication at an upstream proxy before requests reach SGLang.
Enforce request schema validation at the gateway to constrain bootstrap_room size, format, and rate.
Deploy SGLang workers behind a load balancer with strict connection and request quotas per client identity.

bash

# Example: restrict access to the SGLang decode endpoint with iptables
iptables -A INPUT -p tcp --dport 30000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 30000 -j DROP

# Example: enforce a container memory limit to bound OOM impact
docker run --memory=32g --memory-swap=32g --restart=on-failure sglang:0.5.19