Mingkai Yu

sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes

LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization

SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker

SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations

SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx

SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching

SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate

Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs

LMCache through 0.5.5 Missing Authentication in Frontend Node Catalog Allows SSRF Allowlist Bypass

LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint