CVE-2026-109227 Details
Description
SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and concurrent requests exhaust worker memory causing denial of service.
A memory exhaustion vulnerability causing denial-of-service has been identified in SGLang versions through 0.5.21. The issue resides in the Qwen-VL video preprocessing component, specifically within the 'preprocess_video' function of 'qwen_vl.py'. This vulnerability allows remote attackers to upload high-resolution videos to the '/v1/chat/completions' endpoint on Qwen-VL deployments. The vulnerability arises because the application decodes video frames at full resolution before applying pixel limits, leading to excessive memory allocation. Concurrently processed high-resolution videos can exhaust worker memory, causing service disruptions.
Users can update to SGLang version 0.5.22 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sgl-project/sglang/issues/43710 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/sgl-project/sglang | [email protected] | Vendor |
| https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/multimodal/processors/qwen_vl.py#L267-L306 | [email protected] | Broken LinkSource CodeVendor |
| https://github.com/sgl-project/sglang/issues/43710 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/sglang-through-0.5.21-memory-exhaustion-dos-via-qwen-vl-video-preprocessing | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SGLang | <= 0.5.21 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |