Description
SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash via /generate to disclose another request's image content or corrupt victims' responses.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
sgl-project sglang
Default version status: unaffected
0.5.13 to ≤ 0.5.21affected
pkg:github/sgl-project/sglangReferences
- https://github.com/sgl-project/sglang/issues/44641 ↗
- https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/managers/tokenizer_manager.py#L1183-L1215 ↗
- https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/managers/io_struct.py#L205-L215 ↗
- https://github.com/sgl-project/sglang/pull/44653 ↗
- https://www.vulncheck.com/advisories/sglang-through-0.5.21-kv-cache-poisoning-via-mm-hashes-in-generate ↗