CVE-2026-109227 in SGLang
Summary
by MITRE • 10/12/2026
SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and concurrent requests exhaust worker memory causing denial of service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in SGLang versions up to 0.5.21 represents a critical unbounded memory allocation flaw located within the video preprocessing module for the Qwen-VL model architecture. Specifically, the defect resides in the preprocess_video function found in qwen_vl.py, where the system fails to enforce resolution constraints prior to decoding video frames from their original source format. This architectural oversight means that when a user submits a high-resolution video payload via the /v1/chat/completions endpoint, the application attempts to decode every frame at its native, potentially massive, pixel count before any subsequent logic can apply configured limits such as max_pixels. By bypassing these safeguards during the initial decoding phase, the software allocates memory proportional to the raw input size rather than a normalized or capped dimension, creating an immediate and severe resource consumption risk for the hosting environment.
From an operational perspective, this flaw allows remote attackers to trigger a denial of service condition with relative ease by submitting carefully crafted video files that exceed typical resolution thresholds. Because modern large language model deployments often handle concurrent requests through worker processes or threads, the memory exhaustion caused by one high-resolution request can rapidly cascade across multiple workers if such inputs are submitted in parallel. The result is not merely a single process crash but a systemic degradation of service availability as available system RAM is depleted faster than it can be reclaimed or garbage collected. This effectively renders the inference endpoint unresponsive to legitimate users, disrupting business continuity and potentially causing data loss for active sessions that were interrupted by the sudden termination of worker processes due to out-of-memory errors.
This vulnerability aligns with CWE-789: Uncontrolled Memory Allocation, as the application does not properly restrict the amount of memory resources consumed based on user input size or complexity. Furthermore, it maps directly to MITRE ATT&CK technique T1496: Resource Hijacking under the broader category of Impact, where adversaries leverage system resource consumption to degrade service availability rather than compromising confidentiality or integrity. The attack vector is classified as Remote (Network) with Low Complexity, indicating that no authentication bypass is necessarily required if the endpoint is publicly accessible and lacks sufficient input validation at the API gateway level.
To mitigate this risk, immediate remediation should focus on enforcing resolution limits before any decoding operations occur within the preprocessing pipeline. Developers must validate video dimensions against a strict maximum pixel count or frame size threshold prior to invoking image decoders such as Pillow or OpenCV. Implementing these checks ensures that memory allocation remains bounded and predictable regardless of input characteristics. Additionally, deploying rate limiting and payload size restrictions at the reverse proxy or API gateway layer can provide an essential defense-in-depth measure by rejecting excessively large video uploads before they reach the application logic. Upgrading to a patched version of SGLang where this preprocessing order has been corrected is also critical for long-term security posture maintenance in production environments running Qwen-VL models.