Unbounded Memory Allocation Vulnerability in SGLang Affecting Qwen-VL Video Processing

CVE-2026-109227

What is CVE-2026-109227?

The unbounded memory allocation vulnerability in SGLang, specifically in the preprocess_video function found in qwen_vl.py, poses a significant risk. This issue allows remote attackers to send high-resolution video frames to the /v1/chat/completions endpoint, bypassing max_pixels limits and leading to potential memory exhaustion. As multiple requests are processed simultaneously, it can exhaust the worker memory, resulting in a denial of service for the application.

References