CVE-2026-109225: SGLang Unbounded Memory Allocation DoS

CVE-2026-109225 Overview

CVE-2026-109225 is an unbounded memory allocation vulnerability [CWE-770] in SGLang through version 0.5.21. The flaw affects the /v1/audio/transcriptions endpoint exposed by the SGLang HTTP server. Unauthenticated remote attackers can send concurrent oversized multipart uploads that the server reads fully into memory before performing any size validation. The result is memory exhaustion of the HTTP and tokenizer worker processes, causing a denial of service against the inference runtime.

Critical Impact
Unauthenticated attackers can crash SGLang HTTP and tokenizer workers remotely by uploading oversized audio files, resulting in service denial for all inference consumers.

Affected Products

SGLang through version 0.5.21
SGLang HTTP server component (python/sglang/srt/entrypoints/http_server.py)
SGLang /v1/audio/transcriptions API endpoint

Discovery Timeline

2026-10-12 - CVE-2026-109225 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109225

Vulnerability Analysis

SGLang is a serving framework for large language models and multimodal workloads. The HTTP server exposes an OpenAI-compatible audio transcription endpoint at /v1/audio/transcriptions that accepts multipart file uploads. The handler reads the uploaded file payload into memory in its entirety before applying any size, type, or quota validation. This read-before-validate pattern enables memory exhaustion when attackers supply oversized inputs.

Because the endpoint accepts anonymous requests, attackers do not need credentials or prior access to the model-serving environment. Concurrent large multipart uploads multiply resident memory consumption across the HTTP worker and the tokenizer worker processes. When memory pressure exceeds host limits, the Python processes are terminated, which halts inference for all tenants of the SGLang instance. For technical details, see the VulnCheck sglang Memory Exhaustion Advisory and the GitHub sglang Code Snippet.

Root Cause

The root cause is missing input-size enforcement before buffering uploaded content. The transcription handler calls the file read method on the multipart part without an upper bound, and no upstream middleware caps request body size. This is a classic allocation-of-resources-without-limits weakness tracked as [CWE-770].

Attack Vector

An attacker reaches the vulnerable endpoint over the network and submits one or more HTTP POST requests to /v1/audio/transcriptions containing a very large file field. Issuing these requests concurrently amplifies memory use until the worker processes are killed by the operating system or Python runtime. No authentication, user interaction, or special privileges are required. The reported upstream issue is tracked at GitHub sglang Issue #43709.

The vulnerability does not describe code execution, data disclosure, or integrity impact. Availability is the sole affected property.

Detection Methods for CVE-2026-109225

Indicators of Compromise

Repeated HTTP POST requests to /v1/audio/transcriptions with abnormally large Content-Length values from one or more source addresses.
SGLang HTTP or tokenizer worker processes terminated by the OOM killer, visible in dmesg or journalctl as Out of memory: Killed process ... python entries.
Sudden spikes in resident set size (RSS) for SGLang Python workers followed by process restarts or 5xx responses from the inference API.

Detection Strategies

Alert on HTTP request bodies exceeding an operationally reasonable audio upload size (for example, several hundred MB) targeting the SGLang API.
Correlate inference endpoint 5xx responses and worker restarts with concurrent large multipart uploads from the same client identifiers.
Monitor host-level memory pressure metrics on SGLang nodes and alert when RSS of serving processes approaches cgroup or container memory limits.

Monitoring Recommendations

Export process-level memory metrics for SGLang workers to a central telemetry pipeline and set thresholds against baseline inference workloads.
Capture reverse-proxy access logs with request size and client IP for all /v1/audio/* paths and retain them for incident review.
Track OOM events and container restart counts for pods running SGLang in Kubernetes and tie alerts to the serving namespace.

How to Mitigate CVE-2026-109225

Immediate Actions Required

Place SGLang behind an authenticated reverse proxy or API gateway and block anonymous access to /v1/audio/transcriptions from untrusted networks.
Enforce a request body size limit at the reverse proxy that matches expected audio payloads, rejecting oversized uploads before they reach the SGLang process.
Apply per-client rate limits and concurrency caps on audio transcription endpoints to prevent amplification through parallel uploads.
Run SGLang workers under strict memory cgroup or container limits so a single process crash does not cascade across the host.

Patch Information

At the time of publication, no fixed SGLang release is identified in the enriched CVE data. Review the GitHub sglang Repository and the tracking GitHub sglang Issue #43709 for upstream remediation status, and upgrade to a version later than 0.5.21 once a patched release is available.

Workarounds

Terminate TLS and multipart parsing at an upstream proxy such as NGINX with client_max_body_size configured to a conservative value for audio uploads.
Disable the /v1/audio/transcriptions route at the proxy layer when audio transcription is not required by the deployment.
Require authentication tokens on all inference endpoints and reject requests without valid credentials at the edge.
Isolate SGLang serving pods on dedicated nodes with memory limits that contain blast radius during exhaustion events.

bash

# NGINX example: cap upload size and require auth for the SGLang audio endpoint
location /v1/audio/transcriptions {
    client_max_body_size 25m;
    limit_req zone=sglang_audio burst=5 nodelay;
    auth_request /_auth;
    proxy_pass http://sglang_upstream;
}