CVE-2026-109225 Details
Description
SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before validation, to crash the HTTP/tokenizer worker and deny service.
A memory exhaustion vulnerability has been identified in SGLang versions through 0.5.21. This vulnerability allows unauthenticated remote attackers to disrupt service by uploading oversized files to the '/v1/audio/transcriptions' endpoint. The issue arises because these large multipart uploads are fully read into memory before any validation occurs. As a result, concurrent uploads of large files can crash the HTTP/tokenizer worker, causing a denial-of-service condition.
As of now, there is no specific patch available for this vulnerability. However, users can manually limit the size of uploads to the '/v1/audio/transcriptions' endpoint by implementing a size check before processing the files.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sgl-project/sglang | [email protected] | Vendor |
| https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/entrypoints/http_server.py#L1847-L1871 | [email protected] | Source CodeVendor |
| https://github.com/sgl-project/sglang/issues/43709 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/sglang-through-0.5.21-memory-exhaustion-dos-via-v1-audio-transcriptions-upload | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SGLang | <= 0.5.21 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |