Sglang Through 0.5.21 Memory Exhaustion Dos Via V1 Audio Transcriptions Upload

Back www.vulncheck.com

Sglang Through 0.5.21 Memory Exhaustion Dos Via V1 Audio Transcriptions Upload

www.vulncheck.com • October 12, 2026

Share: View original

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-109225: Memory Exhaustion Vulnerability in SGLang On October 12, 2026, CVE-2026-109225 was published, revealing an unbounded memory allocation vulnerability in SGLang versions up to 0.5.21. This flaw allows unauthenticated remote attackers to exhaust memory by uploading oversized files to the /v1/audio/transcriptions endpoint. Attackers can exploit this by sending concurrent large multipart uploads, potentially crashing the HTTP/tokenizer worker and causing denial of service. The vulnerability poses a significant availability risk for internet-facing AI inference services, particularly those that handle audio transcription. The current status indicates that there is no confirmed exploitation urgency as KEV, SSVC, and EPSS data are not provided. Affected services should monitor for unusually large requests and consider restricting access until a patch is available. 1 sources 57

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

CWE-400 - Uncontrolled Resource Consumption