A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-112082 is a denial of service vulnerability affecting SGLang versions up to 0.5.19, specifically in the Expert-Distribution Recording Endpoint's Scheduler.expert_distribution_handle function. This vulnerability allows remote attackers to manipulate the expert distribution mechanism, causing the service to become unavailable. Organizations deploying SGLang for distributed inference workloads—particularly those using mixture-of-experts (MoE) model architectures—are at immediate risk. The public availability of exploit code and ongoing patch review create a window of exposure for production systems relying on this component.
While this CVE does not map to specific MITRE ATT&CK techniques, practitioners using Casky.ai would detect attack patterns through behavioral anomaly detection across the 754 mapped security skills. The platform's Claude AI-powered analysis would identify suspicious resource exhaustion patterns, unexpected service termination sequences, and abnormal scheduler behavior that precedes a denial of service event. Practitioners would observe findings related to resource consumption anomalies, process crash patterns, and endpoint availability degradation—indicators that point toward exploitation attempts against the vulnerable Scheduler function, enabling them to correlate suspicious activity with known CVE-2026-112082 exploitation signatures before full service compromise occurs.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-112082. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation