CVE-2026-109226: SGLang DOS Decompression Amplification Flaw

CVE-2026-109226 Overview

CVE-2026-109226 is a decompression amplification vulnerability in SGLang through version 0.5.21. The flaw resides in the load_audio function, which decodes attacker-supplied audio without enforcing duration or sample limits. Remote, unauthenticated attackers can submit small compressed audio payloads such as FLAC-encoded silence through audio_url or audio_data inputs. These small inputs expand into large Pulse-Code Modulation (PCM) buffers in memory, exhausting worker memory and CPU on the model serving host. The issue is categorized under [CWE-409] (Improper Handling of Highly Compressed Data).

Critical Impact
Unauthenticated attackers can trigger memory and CPU exhaustion on SGLang inference workers, resulting in denial of service against hosted language model endpoints.

Affected Products

SGLang versions through 0.5.21
SGLang multimodal audio processing pipeline (load_audio)
Deployments exposing audio_url or audio_data inputs to untrusted clients

Discovery Timeline

2026-10-12 - CVE-2026-109226 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109226

Vulnerability Analysis

SGLang is a serving framework for large language and multimodal models. Its multimodal pipeline accepts audio inputs supplied as remote URLs or embedded data. The load_audio helper decodes these payloads into raw PCM arrays before passing them to the model processor.

The decoder does not cap decoded sample count, decoded duration, or resulting buffer size. An attacker can craft a small FLAC file containing extended silence, which compresses to a few kilobytes but decodes into gigabytes of raw samples. Each concurrent request forces the worker to allocate the full decoded buffer, exhausting resident memory and consuming CPU cycles during resampling.

The vulnerability is network reachable, requires no authentication, and no user interaction. The impact is confined to availability of the serving process.

Root Cause

The root cause is missing validation of decoded audio size inside the audio loading path referenced in python/sglang/srt/multimodal/audio_from_video.py and python/sglang/srt/utils/common.py. The code decodes compressed audio using standard libraries without checking the ratio of input bytes to decoded samples before allocation.

Attack Vector

The attacker sends a POST request to a multimodal SGLang endpoint containing an audio_url pointing to a crafted FLAC file, or an audio_data field with base64-encoded compressed audio. The worker fetches and decodes the payload. Repeated or parallel submissions compound memory pressure until the worker process is killed by the operating system out-of-memory handler.

For technical details, see the VulnCheck Advisory for SGLang and the upstream SGL Project GitHub Issue #43708.

Detection Methods for CVE-2026-109226

Indicators of Compromise

Inbound requests to multimodal inference endpoints containing audio_url or audio_data fields with small payloads followed by abnormal worker memory growth.
SGLang worker processes terminated by the Linux OOM killer, visible in dmesg or /var/log/messages.
Repeated connections from a single source retrieving the same compressed audio asset immediately before worker restarts.

Detection Strategies

Instrument the SGLang serving process to log decoded audio sample counts and reject outliers exceeding a configured maximum.
Alert on resident set size (RSS) spikes that exceed baseline memory allocations for inference workers within a short time window.
Correlate HTTP request logs that include audio_url or audio_data parameters with subsequent worker crashes or restarts.

Monitoring Recommendations

Monitor per-request latency and memory metrics exported by SGLang and the host runtime for sudden deviations.
Track upstream fetches initiated by the serving host to external domains referenced in audio_url values.
Enable rate-limit telemetry at the ingress proxy for multimodal endpoints and alert on bursts from single clients.

How to Mitigate CVE-2026-109226

Immediate Actions Required

Restrict access to SGLang multimodal endpoints that accept audio_url or audio_data to authenticated clients only.
Enforce request-level limits on compressed audio byte size and reject payloads whose decoded duration cannot be determined upfront.
Deploy per-client rate limits and concurrency caps on multimodal inference routes at the reverse proxy or API gateway.

Patch Information

At the time of publication, SGLang 0.5.21 is the latest affected version noted in the advisory. Monitor the SGL Project GitHub Repository and SGL Project GitHub Issue #43708 for a fixed release and upgrade as soon as patches become available. Review the vulnerable code paths in audio_from_video.py and common.py for local hotfix candidates.

Workarounds

Disable the audio input modality on SGLang servers that do not require audio inference.
Validate and bound audio inputs upstream by decoding in a sandboxed service that enforces maximum duration, sample rate, and output buffer size before forwarding to SGLang.
Place a web application firewall rule in front of the inference endpoint to block requests whose audio_url references untrusted domains.

bash

# Example NGINX constraint for multimodal endpoint request size
location /v1/audio {
    client_max_body_size 1m;
    limit_req zone=audio_zone burst=5 nodelay;
    proxy_pass http://sglang_backend;
}