High severity7.5NVD Advisory· Published Oct 12, 2026· Updated Oct 12, 2026
CVE-2026-109225
CVE-2026-109225
Description
SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before validation, to crash the HTTP/tokenizer worker and deny service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=0.5.21
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.