Resource Budget Bypass in SGLang Allows Remote Exploitation

CVE-2026-109228

What is CVE-2026-109228?

SGLang versions through 0.5.21 are susceptible to a resource budget bypass vulnerability. This issue enables remote actors to manipulate video processing limits by altering parameters such as fps, max_frames, max_tokens_per_frame, and max_image_tokens within the video_url object. By setting these values excessively high, attackers can force the glm4v.py component to decode every frame of high-resolution video fully, leading to memory exhaustion and potential denial of service. This oversight can impose heavy loads on worker memory, adversely affecting system stability and availability.

References