Decompression Amplification Vulnerability in SGLang by SGL Project

CVE-2026-109226

What is CVE-2026-109226?

SGLang version 0.5.21 is affected by a decompression amplification vulnerability in the load_audio function. This vulnerability enables remote attackers to exploit the application by sending maliciously crafted, highly compressed audio files. These files, particularly small FLAC-encoded silence files submitted via audio_url or audio_data inputs, expand into large PCM buffers that can exceed memory limits, leading to resource exhaustion and potential denial of service scenarios. Attackers can leverage this vulnerability to disrupt service and degrade performance significantly.

References