CVE-2026-109228: SGLang DOS Vulnerability via Resource Bypass

CVE-2026-109228 Overview

CVE-2026-109228 is a resource exhaustion vulnerability in SGLang through version 0.5.21. The flaw allows remote, unauthenticated attackers to bypass server-side video processing budgets for the GLM-V multimodal pipeline. By supplying attacker-controlled fps, max_frames, max_tokens_per_frame, and max_image_tokens fields inside the video_url object of an inference request, callers can override safe defaults enforced by the server. The glm4v.py processor then decodes every frame of a high-resolution video at full resolution, exhausting worker memory and causing denial of service. The weakness is tracked under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact

Unauthenticated attackers can crash SGLang inference workers and deny service to all tenants sharing the GPU host with a single crafted request.

Affected Products

• SGLang through version 0.5.21
• SGLang deployments exposing the OpenAI-compatible /v1/chat/completions endpoint with GLM-V multimodal models enabled
• Workloads using the glm4v.py multimodal processor path

Discovery Timeline

• 2026-10-12 - CVE-2026-109228 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-109228

Vulnerability Analysis

SGLang is a serving framework for large language and multimodal models. The GLM-V pipeline processes video inputs by sampling frames, encoding them as image tokens, and feeding the resulting tensor to the model. Normally the server enforces a budget on frames per second, total frames, tokens per frame, and total image tokens to bound memory and compute. CVE-2026-109228 arises because the request schema in protocol.py accepts client-supplied values for these budget fields inside the video_url object and the GLM-V processor applies them without validation against trusted server-side ceilings. A single request can set each value arbitrarily high, forcing full-resolution decode of every frame in a long high-resolution clip. The attack requires no authentication and no user interaction, and completes over the network against any exposed endpoint.

Root Cause

The root cause is missing enforcement of maximum values on untrusted input. The schema at python/sglang/srt/entrypoints/openai/protocol.py lines 592-594 defines fps, max_frames, max_tokens_per_frame, and max_image_tokens as optional per-request fields. The processor at python/sglang/srt/multimodal/processors/glm4v.py lines 160-167 and line 400, together with the conversation parser at python/sglang/srt/parser/conversation.py line 691, consumes those values directly. Server-side defaults exist but are overridden by any value the caller provides, violating the resource throttling expectation described in CWE-770.

Attack Vector

An attacker sends an OpenAI-style chat completion request to a vulnerable SGLang instance. The messages array includes a video_url content part referencing a high-resolution video and setting max_frames, max_tokens_per_frame, max_image_tokens, and fps to large integers. The GLM-V processor then decodes the entire video at full resolution and allocates image token tensors sized by the attacker-supplied token caps. Worker memory is exhausted, the serving process is terminated by the operating system, and queued requests from other tenants fail. Repeating the request sustains the denial of service. See the VulnCheck Advisory on sglang and GitHub Issue #43705 for the full disclosure.

Detection Methods for CVE-2026-109228

Indicators of Compromise

• Chat completion requests whose JSON body contains a video_url object with max_frames, max_tokens_per_frame, max_image_tokens, or fps set well above documented defaults.
• Repeated inference requests from a single source referencing large or externally hosted high-resolution video URLs.
• SGLang worker processes terminated by the Linux Out-Of-Memory killer shortly after a multimodal request arrives.
• GPU host memory and swap saturation correlated in time with inbound /v1/chat/completions traffic.

Detection Strategies

• Inspect reverse-proxy or API-gateway logs for request bodies that include GLM-V video budget fields, and alert on values exceeding operator-defined thresholds.
• Baseline normal per-request memory allocation on SGLang workers and alert on sudden multi-gigabyte spikes tied to a single request ID.
• Correlate kernel oom-killer messages for the SGLang Python process with inbound multimodal request timestamps.

Monitoring Recommendations

• Export SGLang request metrics and GPU memory telemetry to a central analytics platform to track frame-decode counts per request.
• Alert on unauthenticated access to the SGLang endpoint from untrusted networks.
• Track frequency of video_url requests per source address and apply rate limits where sustained bursts occur.

How to Mitigate CVE-2026-109228

Immediate Actions Required

• Restrict network exposure of SGLang inference endpoints to trusted clients using firewall rules or an authenticating reverse proxy.
• Strip or override the fps, max_frames, max_tokens_per_frame, and max_image_tokens fields from inbound video_url objects at the gateway layer.
• Disable the GLM-V multimodal route if video inference is not required in the deployment.
• Monitor the GitHub sglang Project release notes for a fixed version and plan an upgrade.

Patch Information

At the time of publication no fixed SGLang release is listed in the advisory references. Track GitHub Issue #43705 and the VulnCheck Advisory on sglang for remediation status. Upgrade to any release later than 0.5.21 that enforces server-side ceilings on the GLM-V budget parameters, and verify by reviewing the referenced code paths in protocol.py and glm4v.py.

Workarounds

• Place a request-filtering reverse proxy in front of SGLang that rejects or sanitizes video_url payloads containing budget fields.
• Enforce container-level memory limits on SGLang workers so a single abusive request terminates only one worker rather than the host.
• Apply per-client rate limits and request size caps at the ingress layer to limit sustained resource consumption.
• Require authentication and per-tenant quotas on the inference endpoint to attribute and throttle abusive callers.

# Example NGINX snippet: strip attacker-controlled budget fields and cap body size
http {
    client_max_body_size 2m;
    limit_req_zone $binary_remote_addr zone=sglang:10m rate=5r/s;

    server {
        listen 443 ssl;
        location /v1/chat/completions {
            limit_req zone=sglang burst=10 nodelay;
            # Route through a filter service that removes fps, max_frames,
            # max_tokens_per_frame, and max_image_tokens from video_url objects
            proxy_pass http://sglang_sanitizer_upstream;
        }
    }
}