Description

SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial of service against the target server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-22T15:17:24.587Z",
  "pubdate": "2026-09-22T15:17:24.587Z",
  "executiveSummary": "SGLang contains a critical denial-of-service (DoS) vulnerability within its Decode worker component. The issue stems from insufficient input validation when processing AUX_DATA messages sent via the ZeroMQ control protocol.\nAn unauthenticated, remote attacker possessing network reachability to the Decode control PULL socket can trigger this vulnerability. By crafting malicious input, the attacker can cause the Decode control thread to terminate abruptly, resulting in a complete service interruption for the affected worker.\nThis vulnerability poses a significant risk to availability, as it allows unauthorized actors to disrupt system operations without requiring valid credentials or high-level privileges. The primary requirement for exploitation is direct network access to the ZeroMQ socket used for control signaling. Given the architecture of the Decode worker, this failure leads to process instability that necessitates manual intervention or automated restart procedures to restore functionality.",
  "technicalDetails": "The vulnerability resides in the SGLang Decode worker's implementation of the ZeroMQ-based inter-process communication (IPC) and control mechanism. Specifically, the processing logic for AUX_DATA control messages fails to perform robust validation of the input payload provided by external clients.\nThe ZeroMQ PULL socket, which is intended for management and control operations, acts as the entry point for this attack. When a message marked as AUX_DATA is received, the system attempts to process the payload without verifying its structural integrity or data contents. An attacker can transmit a malformed or unexpected ZeroMQ message to this socket, which the Decode control thread processes synchronously.\nThe root cause is an unhandled exception or logic error triggered when the thread encounters data that violates expected internal formats within the AUX_DATA structure. Because the control thread does not implement comprehensive exception handling or bounds checking for these specific control frames, the improper data leads to a thread-level crash. Since this component is essential for coordinating the Decode worker, the termination of the control thread effectively renders the entire worker non-responsive to legitimate management commands and task processing requests.\nThe attack flow is as follows: 1) The attacker identifies network reachability to the ZeroMQ control PULL socket. 2) The attacker constructs a payload conforming to the ZeroMQ framing expected by the socket but containing malicious or malformed AUX_DATA content. 3) The attacker transmits this frame to the target socket. 4) The Decode worker's control thread ingests the message and proceeds to parse the AUX_DATA. 5) Due to missing validation, the parsing logic fails, triggering an unhandled exception or critical state error. 6) The control thread dies, resulting in a denial-of-service condition for the Decode worker process.\nThe impact of successful exploitation is the loss of service availability for the target SGLang node. Because this interface is often exposed to facilitate cluster management, the lack of authentication on the PULL socket allows any user on the local network—or a routed segment—to execute the attack. Post-exploitation, the service remains in a failed state, unable to perform its intended decoding tasks until the process is restarted."
}