GitHub Advisoryadvisory · PyPI

GHSA-jrcc-j37m-v8fg SGLang is Vulnerable to DoS via the data_hash Function

LOW Published 2026-06-04 Modified 2026-08-17 Official page ↗
Aliases
CVE-2026-10775
Ecosystem
PyPI
Packages
sglang
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-404
Reviewed
2026-08-17

Affected packages

• PyPI sglang: <= 0.5.11 (no fix yet)

Description

A vulnerability was determined in sgl-project SGLang up to 0.5.11. Affected by this vulnerability is the function data_hash of the component Cache Handler. This manipulation causes denial of service. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

Related

Alias · CVE (1)

  • CVE-2026-10775 A vulnerability was determined in sgl-project SGLang up to 0.5.11. vulnerability

Weakness · CWE (1)

  • CWE-404 Improper Resource Shutdown or Release weakness

References