Unbounded Memory Allocation Vulnerability in SGLang by SGL Project

CVE-2026-109225

What is CVE-2026-109225?

SGLang versions up to 0.5.21 are susceptible to an unbounded memory allocation vulnerability that permits unauthenticated remote attackers to exploit the '/v1/audio/transcriptions' endpoint. By uploading oversized files through concurrent large multipart uploads, attackers can cause substantial memory exhaustion, potentially crashing the HTTP/tokenizer worker, leading to a denial of service. This critical flaw, which occurs as uploaded files are processed without prior validation, highlights significant risks associated with handling file uploads.

References