CVE-2026-109225 in SGLang
Summary
by MITRE • 10/12/2026
SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before validation, to crash the HTTP/tokenizer worker and deny service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The SGLang framework, specifically in versions up through 0.5.21, contains a critical unbounded memory allocation vulnerability that poses a significant risk of denial-of-service attacks against systems hosting audio transcription services. This flaw is located within the endpoint /v1/audio/transcriptions and stems from an architectural decision where incoming multipart file uploads are fully loaded into system memory prior to any validation checks regarding size or format constraints. By design, this approach aims to simplify processing logic but inadvertently creates a severe resource exhaustion vector that can be exploited by unauthenticated remote attackers without requiring valid credentials or authentication tokens.
The technical mechanism of the exploit relies on sending concurrent requests containing oversized multipart uploads. Because the framework reads the entire payload into memory before verifying whether the file size exceeds acceptable limits, an attacker can deliberately craft large payloads to consume available RAM resources rapidly. The concurrency aspect is particularly dangerous as it allows multiple simultaneous connections to saturate system memory simultaneously, overwhelming the HTTP server and tokenizer worker processes. This leads to a complete service outage where legitimate users are unable to access transcription services due to resource starvation or process crashes caused by out-of-memory conditions.
From an operational impact perspective, this vulnerability effectively enables remote denial of service attacks that can disrupt business continuity for any organization relying on SGLang for audio processing tasks. The lack of authentication requirements means the attack surface is broad and accessible to anyone with network connectivity to the affected endpoint. Furthermore, because the memory exhaustion occurs before validation, traditional input sanitization or size-limiting middleware placed after initial request parsing may not mitigate this specific issue unless implemented at a lower level in the HTTP stack itself. The crash of tokenizer workers also implies potential data loss for any ongoing processing tasks and requires manual intervention to restart services, increasing downtime and operational costs.
This vulnerability aligns with CWE-400, which describes uncontrolled resource consumption leading to denial of service conditions. It is further categorized under ATT&CK technique T1498, Network Denial of Service, specifically reflecting the direct network-based exhaustion of resources through volumetric attacks. To mitigate this risk, organizations should implement strict rate limiting and connection throttling at the reverse proxy or load balancer level to prevent concurrent large uploads from overwhelming backend services. Additionally, enforcing maximum upload size limits before data is fully ingested into application memory is essential; developers must validate content length headers and stream file processing rather than loading entire payloads into RAM. Upgrading to a patched version of SGLang that addresses this allocation flaw or applying temporary network-level controls are recommended immediate steps to secure the environment against exploitation.