CVE-2026-112083
Full vulnerability record from the local CVENow database.
Description
A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send_weights_to_remote_instance of the file python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of the component Weight Exporter. Performing a manipulation of the argument group_name results in denial of service. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
Severity
MEDIUM
CVSS score
5.5
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-10-19 06:17:23.377000
Last modified
2026-10-19 17:17:11.287000
View original CVE JSON
{
"id": "CVE-2026-112083",
"sourceIdentifier": "[email protected]",
"published": "2026-10-19T06:17:23.377",
"lastModified": "2026-10-19T17:17:11.287",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send_weights_to_remote_instance of the file python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of the component Weight Exporter. Performing a manipulation of the argument group_name results in denial of service. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "sgl-project",
"product": "SGLang",
"cpes": [
"cpe:2.3:a:sgl-project:sglang:*:*:*:*:*:*:*:*"
],
"modules": [
"Weight Exporter"
],
"versions": [
{
"version": "0.5.0",
"status": "affected"
},
{
"version": "0.5.1",
"status": "affected"
},
{
"version": "0.5.2",
"status": "affected"
},
{
"version": "0.5.3",
"status": "affected"
},
{
"version": "0.5.4",
"status": "affected"
},
{
"version": "0.5.5",
"status": "affected"
},
{
"version": "0.5.6",
"status": "affected"
},
{
"version": "0.5.7",
"status": "affected"
},
{
"version": "0.5.8",
"status": "affected"
},
{
"version": "0.5.9",
"status": "affected"
},
{
"version": "0.5.10",
"status": "affected"
},
{
"version": "0.5.11",
"status": "affected"
},
{
"version": "0.5.12",
"status": "affected"
},
{
"version": "0.5.13",
"status": "affected"
},
{
"version": "0.5.14",
"status": "affected"
},
{
"version": "0.5.15",
"status": "affected"
},
{
"version": "0.5.16",
"status": "affected"
},
{
"version": "0.5.17",
"status": "affected"
},
{
"version": "0.5.18",
"status": "affected"
},
{
"version": "0.5.19",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"baseScore": 5.0,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-19T15:46:38.788229Z",
"id": "CVE-2026-112083",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-404"
}
]
}
],
"references": [
{
"url": "https://github.com/sgl-project/sglang/",
"source": "[email protected]"
},
{
"url": "https://github.com/sgl-project/sglang/issues/42073",
"source": "[email protected]"
},
{
"url": "https://github.com/sgl-project/sglang/pull/44314",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-112083",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/1009919",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/421762",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/421762/cti",
"source": "[email protected]"
}
]
}