CVE-2026-109229 in SGLang
Summary
by MITRE • 10/12/2026
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic image loader, exhausting worker memory during decoding.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The SGLang framework, specifically through version 0.5.21, contains a critical denial of service vulnerability rooted in the improper handling of image processing configurations within its vision-language model integration components. This flaw is primarily located in the NanoNemotronVLImageProcessor class, which serves as an interface for loading and preprocessing images before they are fed into large language models that support multimodal inputs. The core technical deficiency involves the explicit setting of Image.MAX_IMAGE_PIXELS to None via the Pillow library's configuration parameters. In standard Python image processing workflows using Pillow, MAX_IMAGE_PIXELS acts as a safeguard against decompression bombs by raising an exception if an image exceeds a predefined pixel count threshold during decoding. By disabling this limit process-wide, the application removes a fundamental layer of defense against resource exhaustion attacks targeting the image parsing subsystem.
This vulnerability allows remote attackers to exploit the generic image loader mechanism by submitting carefully crafted requests containing small file sizes but with extremely large intrinsic dimensions or high compression ratios that result in massive uncompressed pixel counts upon decompression. Because the protection is disabled globally rather than scoped to specific safe operations, any attempt to decode such an image triggers a full expansion of data into system memory without restriction. The operational impact is severe, as the decoding process consumes excessive amounts of RAM on the worker processes responsible for handling inference requests. This leads to rapid resource exhaustion, causing the application workers to crash or become unresponsive, thereby resulting in a complete denial of service for legitimate users attempting to access the model services.
From a classification perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as well as CWE-787, Out-of-bounds Write, if the memory allocation leads to buffer overflows or heap corruption during the decompression process. In terms of attack vectors and tactics, it corresponds to MITRE ATT&CK technique T1496, Resource Hijacking, where an attacker uses computing resources for their own purposes by exhausting system capacity, effectively disrupting availability rather than compromising confidentiality or integrity directly. The exploitability is heightened because image processing is often a required step in multimodal AI pipelines, making it a frequent target for adversarial inputs designed to destabilize the hosting infrastructure.
Mitigation strategies should focus on immediate patching of SGLang to versions later than 0.5.21 where this configuration error has been addressed by developers who likely restored appropriate limits or implemented scoped context managers that do not affect global state. In environments where upgrading is not immediately feasible, administrators can implement network-level filtering rules to restrict the size and dimensions of incoming image payloads before they reach the application layer. Additionally, deploying resource monitoring tools that detect abnormal spikes in memory usage associated with image processing tasks can provide early warning indicators for such attacks. It is also recommended to run inference workers under strict containerized environments with defined memory limits using cgroups or Kubernetes resources to contain the blast radius of any successful exploitation attempt and prevent cascading failures across the entire cluster.