Common Weakness Enumeration
CWE-694
AllowedUse of Multiple Resources with Duplicate Identifier
Abstraction: Base · Status: Incomplete
The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.
22 vulnerabilities reference this CWE, most recent first.
GHSA-MJGP-HGFR-77JQ
Vulnerability from github – Published: 2026-09-29 18:31 – Updated: 2026-09-29 18:31
VLAI
Details
SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstrap_room values to crash scheduler processes or hang other users' requests until transfer timeout.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-102634"
],
"database_specific": {
"cwe_ids": [
"CWE-694"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-29T17:17:07Z",
"severity": "HIGH"
},
"details": "SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstrap_room values to crash scheduler processes or hang other users\u0027 requests until transfer timeout.",
"id": "GHSA-mjgp-hgfr-77jq",
"modified": "2026-09-29T18:31:50Z",
"published": "2026-09-29T18:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102634"
},
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang/issues/40125"
},
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang"
},
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/common/conn.py#L392-L393"
},
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/decode.py#L942"
},
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/mooncake/conn.py#L2760-L2764"
},
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/managers/io_struct.py#L281"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/sglang-through-0.5.20-denial-of-service-via-duplicate-bootstrap-room"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-XH5W-G8GQ-R3V9
Vulnerability from github – Published: 2025-11-24 18:31 – Updated: 2026-05-29 20:50
VLAI
Summary
Keylime allows users to register new agents by recycling existing UUIDs when using different TPM devices
Details
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.
Severity
8.2 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keylime"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.13.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-13609"
],
"database_specific": {
"cwe_ids": [
"CWE-694"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-26T19:32:37Z",
"nvd_published_at": "2025-11-24T18:15:49Z",
"severity": "HIGH"
},
"details": "A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent\u0027s unique identifier (UUID). This action overwrites the legitimate agent\u0027s identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.",
"id": "GHSA-xh5w-g8gq-r3v9",
"modified": "2026-05-29T20:50:19Z",
"published": "2025-11-24T18:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13609"
},
{
"type": "WEB",
"url": "https://github.com/keylime/keylime/issues/1820"
},
{
"type": "WEB",
"url": "https://github.com/keylime/keylime/pull/1785"
},
{
"type": "WEB",
"url": "https://github.com/keylime/keylime/commit/e1ae8de1f7b1385eaeec66572a92ff1338e6e157"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23201"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23210"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23628"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23735"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23852"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0429"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-13609"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416761"
},
{
"type": "PACKAGE",
"url": "https://github.com/keylime/keylime"
},
{
"type": "WEB",
"url": "https://github.com/keylime/keylime/releases/tag/v7.13.0"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/keylime/PYSEC-2025-77.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Keylime allows users to register new agents by recycling existing UUIDs when using different TPM devices"
}
Mitigation
Architecture and Design
Where possible, use unique identifiers. If non-unique identifiers are detected, then do not operate any resource with a non-unique identifier and report the error appropriately.
No CAPEC attack patterns related to this CWE.