{"vulnerability": "CVE-2026-94570", "sightings": [{"uuid": "f2fea3ef-30ec-422b-83f4-667cd1556f9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94570", "type": "seen", "source": "https://gist.github.com/yyymk/b5892625cb5efa2bffd36e0b05334ae8", "content": "# CVE-2026-94570: Internal denial of service in SGLang Mooncake disaggregation\n\n## Summary\n\nCVE-2026-94570 is an internal control-plane denial-of-service vulnerability in SGLang deployments using Prefill/Decode disaggregation with the Mooncake transfer backend.\n\nA network peer that can reach the Decode worker's internal ZeroMQ control socket can send a malformed `AUX_DATA` multipart message containing an out-of-range `buffer_index`. SGLang uses this index to access `kv_args.aux_data_ptrs` without first validating its bounds.\n\nThe resulting uncaught `IndexError` terminates the Decode control-receive thread. The Decode process and its HTTP `/health` endpoint remain available, but subsequent Prefill-to-Decode inference requests cannot complete and eventually time out.\n\nThe vulnerability was dynamically reproduced on SGLang `0.5.15.post1`.\n\n## Affected configuration\n\nThe tested deployment used:\n\n| Component | Version or configuration |\n| --- | --- |\n| SGLang | `0.5.15.post1` |\n| SGLang Router | `0.3.2` |\n| Mooncake Transfer Engine | `0.3.11.post1` |\n| pyzmq | `27.1.0` |\n| PyTorch | `2.11.0` |\n| Python | `3.12` |\n| Transfer backend | `mooncake_tcp` with `MC_FORCE_TCP=1` |\n| Topology | One Prefill worker, one Decode worker, and SGLang Router |\n| Model | Qwen3-8B |\n| Operating system | Ubuntu 22.04 |\n| Hardware | Two NVIDIA A100 80 GB GPUs |\n\nThe vulnerable path is present only when Prefill/Decode disaggregation is enabled with the Mooncake transfer backend.\n\n## Attack prerequisites\n\nThe attacker must be able to discover and connect to the Decode worker's dynamically allocated ZeroMQ control port.\n\nAccess to the public OpenAI-compatible inference API alone is not sufficient. The vulnerability is reachable from the internal disaggregation network, such as by a malicious or compromised peer with access to the Decode control endpoint.\n\nThe ZeroMQ control socket does not authenticate the sender before processing an `AUX_DATA` message.\n\n## Root cause\n\nThe Mooncake Decode receiver dispatches messages beginning with `AUX_DATA` to `_handle_aux_data()`.\n\nThe handler parses values including:\n\n- `room`\n- `buffer_index`\n- `aux_index`\n- `data_length`\n- the serialized payload\n\nThe payload length is checked, but the handler does not adequately validate the multipart message structure, the bounds of `buffer_index`, the bounds of `aux_index`, the supplied room, or the identity of the sender.\n\n`AuxDataCodec.deserialize_data_to_buffer()` subsequently uses the supplied index directly:\n\n```python\ndst_aux_ptr = kv_args.aux_data_ptrs[buffer_index]\n```\n\nAn out-of-range positive `buffer_index` raises:\n\n```\nIndexError: list index out of range\n```\n\nThe exception is not isolated at the individual-message level. It therefore escapes the handler and terminates the long-lived Decode control-receive thread.\n\nThe relevant code paths in the tested version are:\n\n- `python/sglang/srt/disaggregation/mooncake/conn.py`\n- `python/sglang/srt/disaggregation/common/utils.py`\n- `python/sglang/srt/disaggregation/common/conn.py`\n\n## Reproduction result\n\nBefore the malformed message was delivered:\n\n- A completion request through SGLang Router completed successfully.\n- Router `/health` returned HTTP 200.\n- Decode `/health` returned HTTP 200.\n\nA single `AUX_DATA` message was then sent with an out-of-range positive `buffer_index`.\n\nThe Decode process produced the following exception:\n\n```\nException in thread Thread-2 (decode_thread):\nTraceback (most recent call last):\n  File \".../sglang/srt/disaggregation/mooncake/conn.py\", line 1550, in decode_thread\n    self._handle_aux_data(msg)\n  File \".../sglang/srt/disaggregation/mooncake/conn.py\", line 919, in _handle_aux_data\n    AuxDataCodec.deserialize_data_to_buffer(\n  File \".../sglang/srt/disaggregation/common/utils.py\", line 97, in deserialize_data_to_buffer\n    dst_aux_ptr = kv_args.aux_data_ptrs[buffer_index]\nIndexError: list index out of range\n```\n\nAfter the exception:\n\n- The Decode control-receive thread was no longer running.\n- Decode `/health` continued returning HTTP 200.\n- Router `/health` continued returning HTTP 200.\n- A subsequent completion request through the Router timed out after 90 seconds with zero response bytes.\n- The Decode process itself remained running.\n- No automatic recreation of the terminated control thread was observed.\n\n## Impact\n\nSuccessful exploitation disables the Decode control path and prevents subsequent end-to-end inference requests from completing.\n\nIn a deployment with multiple Decode workers, an affected worker may remain registered and continue passing HTTP health checks even though it can no longer complete Prefill-to-Decode requests. Routers, load balancers, or orchestration systems relying on those health checks may continue directing traffic to the damaged worker.\n\nThe confirmed impact is loss of availability. No confidentiality loss, data modification, privilege escalation, native memory corruption, or code execution was observed.\n\n## Technical remediation\n\nA complete fix should:\n\n- Validate the number and format of all `AUX_DATA` message frames.\n- Reject any `buffer_index` outside the bounds of `kv_args.aux_data_ptrs`.\n- Validate `aux_index` against the allocated destination range.\n- Verify that the room and session belong to an active transfer.\n- Authenticate or authorize the sending peer.\n- Isolate exceptions raised while handling individual control messages.\n- Include the health of the Decode control-receive thread in service health reporting.\n\n## Discovery credit\n\nCVE-2026-94570 was discovered by:\n\n- Mingkai Yu\n- Jiapeng Li\n- Jiajia Liu\n\n## Acknowledgements\n\nWe thank Christopher Cullen of CERT/CC for assisting with the coordination and assignment of CVE-2026-94570.\n", "creation_timestamp": "2026-09-22T04:48:30.779993Z"}]}