CVE-2026-109229: SGLang Denial of Service Vulnerability

CVE-2026-109229 Overview

CVE-2026-109229 is a denial of service vulnerability in SGLang through version 0.5.21. The flaw resides in the NanoNemotronVLImageProcessor, which sets Image.MAX_IMAGE_PIXELS to None. This change disables Pillow's decompression bomb protection process-wide, affecting every image handled by the generic image loader. Remote attackers can submit small, highly compressed images with enormous declared dimensions. When the server decodes these inputs, worker memory is exhausted and the service becomes unresponsive. The weakness is tracked as improper handling of highly compressed data [CWE-409].

Critical Impact
Unauthenticated remote attackers can crash SGLang inference workers by submitting crafted images that trigger uncontrolled memory allocation during decoding.

Affected Products

SGLang through version 0.5.21
NanoNemotronVLImageProcessor component
SGLang generic image loader in python/sglang/srt/utils/common.py

Discovery Timeline

2026-10-12 - CVE-2026-109229 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109229

Vulnerability Analysis

SGLang is a serving framework for large language and vision-language models. The NanoNemotronVLImageProcessor sets Image.MAX_IMAGE_PIXELS = None at module scope. Because Pillow stores this limit as a global class attribute, the override removes decompression bomb protection for every image the process decodes.

Once protection is disabled, the shared image loader will accept arbitrary image dimensions. A multi-gigapixel image decoded into a raw bitmap can consume tens of gigabytes of RAM. Worker processes handling inference requests exhaust available memory and are killed by the OS or hang indefinitely.

The vulnerability requires no authentication and no user interaction. Any client able to submit multimodal inference requests can trigger the condition.

Root Cause

The root cause is an unsafe global configuration change. Pillow exposes MAX_IMAGE_PIXELS as a safeguard against decompression bombs, raising Image.DecompressionBombError when images exceed a threshold. By assigning None to this attribute, the processor opts the entire Python process out of the protection rather than scoping the change locally.

Attack Vector

An attacker crafts a highly compressed image file, such as a PNG with large declared width and height but minimal entropy. The file is small on disk but expands to billions of pixels when decoded. The attacker sends this image to any SGLang endpoint that accepts multimodal input. The generic loader decodes the file into memory without a pixel ceiling, exhausting the worker's RAM. Repeated requests sustain the denial of service against the inference service.

See the VulnCheck Advisory: SGLang DoS and GitHub SGLang Issue #43707 for additional technical context.

Detection Methods for CVE-2026-109229

Indicators of Compromise

SGLang worker processes terminated with out-of-memory signals or oom_reaper kernel messages.
Sudden spikes in resident set size (RSS) on inference workers immediately following multimodal requests.
Inbound image payloads with small file size but very large declared dimensions in PNG/JPEG headers.
HTTP 5xx responses or request timeouts correlated with image upload endpoints.

Detection Strategies

Inspect multimodal request payloads and flag images whose declared dimensions exceed operational thresholds (for example, 25 megapixels).
Monitor the ratio of compressed image size to decoded pixel count; anomalously high ratios indicate decompression bomb patterns.
Correlate worker crashes and restarts with the preceding request logs to identify triggering clients.

Monitoring Recommendations

Export per-worker memory and CPU metrics to a time-series backend and alert on rapid growth.
Enable structured logging in the SGLang image loader to capture image metadata before decoding.
Track rate and source of multimodal requests to detect abusive clients and apply rate limits.

How to Mitigate CVE-2026-109229

Immediate Actions Required

Upgrade SGLang to a release after 0.5.21 that reinstates Pillow's decompression bomb protection.
Restrict network exposure of SGLang inference endpoints to trusted clients and internal networks.
Place a reverse proxy in front of SGLang to enforce request size limits and reject oversized image payloads.
Apply per-client rate limiting on multimodal endpoints to reduce the impact of repeated attacks.

Patch Information

At publication, review the GitHub SGLang Project repository and GitHub SGLang Issue #43707 for the fixed release. The vulnerable code paths are documented in GitHub SGLang Nano Nemotron Script and GitHub SGLang Common Utilities Script.

Workarounds

Patch the deployed SGLang installation to remove the Image.MAX_IMAGE_PIXELS = None assignment in nano_nemotron_vl.py.
Explicitly set Image.MAX_IMAGE_PIXELS to a safe value at application startup, overriding the processor's change.
Validate image dimensions and file size at the API gateway before forwarding requests to SGLang workers.
Run inference workers under cgroup memory limits so a single malicious request cannot destabilize the host.

bash

# Configuration example: enforce a safe pixel ceiling at startup
python -c "from PIL import Image; Image.MAX_IMAGE_PIXELS = 25000000"

# Example nginx limit for upstream SGLang endpoint
client_max_body_size 8m;