CVE-2026-109226 in SGLang
Summary
by MITRE • 10/12/2026
SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio_url or audio_data inputs that expand into massive PCM buffers, exhausting worker memory and CPU for denial of service.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in SGLang versions up to 0.5.21 represents a critical decompression amplification flaw within the load_audio functionality, which is designed to process audio input from various sources including URLs or direct data payloads. This security issue stems from an insufficient validation of media file properties before processing, specifically lacking checks for duration limits and sample rate constraints during the decoding phase. When the system receives an audio file encoded in formats such as FLAC, it proceeds to decompress the stream into raw Pulse Code Modulation PCM buffers without verifying whether the resulting uncompressed data size is reasonable or bounded by predefined thresholds. This architectural oversight allows attackers to craft maliciously small input files that expand exponentially when decoded, leading to a severe resource exhaustion scenario on the target system.
From a technical perspective, the core of this vulnerability lies in the absence of pre-decompression validation and post-decompression bounds checking for memory allocation. The load_audio function accepts audio_url or audio_data inputs and passes them directly to an audio decoding library without first inspecting metadata such as file duration, sample rate, or channel count. An attacker can exploit this by submitting a minimal FLAC-encoded silence file that is only a few kilobytes in size on disk but expands into hundreds of megabytes or even gigabytes when decompressed into memory. Because the system does not enforce limits on the maximum number of samples it will process from a single audio stream, the resulting PCM buffer consumes excessive amounts of RAM and CPU cycles during processing. This behavior effectively turns a small network request into a massive local resource consumption event, bypassing typical size-based filters that might otherwise block large file uploads.
The operational impact of this vulnerability is primarily focused on denial of service against systems running SGLang with exposed audio processing endpoints. By repeatedly submitting these amplified audio payloads, remote attackers can exhaust the available memory resources of worker processes responsible for handling inference or data loading tasks. This leads to process crashes, system instability, and potential cascading failures across distributed deployments where multiple workers share underlying infrastructure limits. The attack does not require authentication if the affected endpoint is publicly accessible, making it a significant threat to availability in cloud-native environments or public-facing APIs that utilize SGLang for multimodal processing capabilities. Service providers relying on this framework may experience degraded performance or complete unavailability of services as worker nodes become overwhelmed by memory pressure and CPU saturation caused by continuous decoding operations.
This vulnerability aligns with Common Weakness Enumeration CWE-409, which describes the improper handling of exceptionally large data structures in decompression processes, often referred to as a Zip Bomb scenario applied to audio formats. It also maps to MITRE ATT&CK technique T1496, Resource Hijacking, where attackers consume significant computational resources to disrupt service availability rather than stealing data or gaining unauthorized access. The exploitation vector is classified under CWE-20 for improper input validation, specifically the failure to validate structural properties of incoming media files before processing them into memory-intensive formats.
To mitigate this risk, developers and system administrators should immediately update SGLang to a version later than 0.5.21 where these bounds have likely been addressed. In environments where an immediate patch is not feasible, implementing strict input validation at the API gateway or load balancer level can provide temporary relief by limiting the maximum size of audio_url requests and rejecting files that exceed expected duration thresholds before they reach the application layer. Additionally, configuring worker processes with memory limits using container orchestration tools like Kubernetes resource quotas can prevent a single malicious request from exhausting all available system memory. It is also recommended to implement timeout mechanisms for decoding operations so that any process attempting to decode an excessively large stream is terminated after a reasonable duration, thereby limiting the window of opportunity for attackers to cause significant damage through sustained denial-of-service attempts.