CVE-2026-109227: SGLang vulnerable to denial of service via unbounded memory allocation in video preprocessing

# CVE-2026-109227: SGLang vulnerable to denial of service via unbounded memory allocation in video preprocessing

https://gcdradar.vercel.app/incidents/cve-2026-109227-sglang-vulnerable-to-denial-of-service-via-u · AIR-2026-1392 · closed 2026-10-12

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-10-12
- AI role: Attack on AI
- Products: SGLang
- CVE ids: CVE-2026-109227
- CVSS: 8.7

## Summary

SGLang up to version 0.5.21 contains an unbounded memory allocation vulnerability in its video preprocessing handler. Remote attackers can exhaust worker memory and cause a denial of service by submitting high-resolution videos.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-10-12: CVE-2026-109227: SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames… (https://nvd.nist.gov/vuln/detail/CVE-2026-109227)

## Sources

- 2026-10-12 NVD: CVE-2026-109227: SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames… https://nvd.nist.gov/vuln/detail/CVE-2026-109227

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.