High
sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service
Type: advisorySources: OSV
A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-112082
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 04:00 UTC · Revision 1
Source evidence
sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service
core-osv · Original sourcePublished 19 Oct 2026, 05:30 UTC
A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
osv:CVE-2026-112082
Complete source record
{
"id": "bdd5733f442bcde8303b53c93a86f7539d1ed5a166e8edcc581096a45513b682",
"url": "https://osv.dev/vulnerability/CVE-2026-112082",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service",
"summary": "A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.",
"evidence": "osv:CVE-2026-112082",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-112082",
"aliases": [
"CVE-2026-112082"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/sgl-project/sglang",
"type": "GIT",
"events": [
{
"introduced": "97a38ee85ba62e268bde6388f1bf8edfe2ca9d76"
},
{
"last_affected": "0bcd822377da7b5718e674eaf9c870d349424dd1"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0.5.1"
},
{
"last_affected": "0.5.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5.2"
},
{
"last_affected": "0.5.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5.3"
},
{
"last_affected": "0.5.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5.4"
},
{
"last_affected": "0.5.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5.5"
},
{
"last_affected": "0.5.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5.6"
},
{
"last_affected": "0.5.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5.7"
},
{
"last_affected": "0.5.7"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5.8"
},
{
"last_affected": "0.5.8"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5.9"
},
{
"last_affected": "0.5.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5.10"
},
{
"last_affected": "0.5.10"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5.11"
},
{
"last_affected": "0.5.11"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5.12"
},
{
"last_affected": "0.5.12"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5.13"
},
{
"last_affected": "0.5.13"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5.14"
},
{
"last_affected": "0.5.14"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5.15"
},
{
"last_affected": "0.5.15"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5.16"
},
{
"last_affected": "0.5.16"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5.17"
},
{
"last_affected": "0.5.17"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5.18"
},
{
"last_affected": "0.5.18"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5.19"
},
{
"last_affected": "0.5.19"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "0.5.19"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"0.5.1",
"0.5.10",
"0.5.11",
"0.5.12",
"0.5.13",
"0.5.14",
"0.5.15",
"0.5.16",
"0.5.17",
"0.5.18",
"0.5.19",
"0.5.2",
"0.5.3",
"0.5.4",
"0.5.5",
"0.5.6",
"0.5.7",
"0.5.8",
"0.5.9",
"v0.5.19",
"gateway-v0.3.1",
"gateway-v0.3.0",
"v0.5.6.post2",
"gateway-v0.2.4",
"v0.5.6.post1",
"v0.5.6",
"v0.5.5",
"v0.5.5.post3",
"gateway-v0.2.3",
"v0.5.5.post2",
"v0.5.5.post1",
"v0.5.4.post3",
"v0.5.4.post2",
"gateway-v0.2.2",
"v0.5.4.post1",
"v0.5.4",
"gateway-v0.2.1",
"v0.5.3.post3",
"v0.5.3.post2",
"gateway-v0.2.0",
"v0.5.3.post1",
"v0.5.3",
"v0.5.3rc2",
"v0.5.3rc1",
"v0.5.3rc0",
"v0.5.2",
"v0.5.2rc2",
"v0.5.2rc1",
"v0.5.2rc0",
"v0.5.1.post3",
"v0.5.1.post2",
"v0.5.1.post1",
"v0.5.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112082.json"
}
}
],
"modified": "2026-10-28T02:30:42.164965794Z",
"provider": "osv",
"references": [
"https://github.com/sgl-project/sglang/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112082.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-112082",
"https://vuldb.com/cve/CVE-2026-112082",
"https://vuldb.com/submit/1009918",
"https://vuldb.com/vuln/421761",
"https://github.com/sgl-project/sglang/issues/42071",
"https://vuldb.com/vuln/421761/cti",
"https://github.com/sgl-project/sglang/pull/42098"
],
"provider_metadata": {
"cwe_ids": [
"CWE-404"
],
"cna_assigner": "VulDB",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "0.5.0"
},
{
"last_affected": "0.5.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112082.json"
}
},
"related_cves": [
{
"value": "CVE-2026-112082",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 510086,
"published_at": "2026-10-19T05:30:22.073+00:00"
}