CVE-2026-110807

MediumCVSS 4.3/10Last modified Oct 15, 2026

Description

A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file python/sglang/srt/managers/io_struct.py of the component generate Endpoint. This manipulation of the argument session_params causes denial of service. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-404

Affected software

Vendor	Product	Versions
sgl-project	SGLang	0.5.0; 0.5.1; 0.5.2; 0.5.3; 0.5.4; 0.5.5; 0.5.6; 0.5.7; 0.5.8; 0.5.9; 0.5.10; 0.5.11; 0.5.12; 0.5.13; 0.5.14; 0.5.15; 0.5.16; 0.5.17; 0.5.18; 0.5.19

References

Timeline

Published: Oct 14, 2026
Last modified: Oct 15, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1108084.2The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts crea CVE-2026-1108094.3A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.create_req of CVE-2026-110816.5Inappropriate implementation in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a CVE-2026-1108102.8A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. This affects the function whisper_model_load of the file src/whisper.cpp o CVE-2026-1108129.9Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote ac CVE-2026-1108137.5The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified t CVE-2026-1108165.3### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element CVE-2026-110829.6Race in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potenti CVE-2026-1108257.5The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without CVE-2026-1108266.3Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker hol CVE-2026-1108296.5FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST wi CVE-2026-110836.5Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data