SGLang: oversized audio uploads are buffered in memory, crashing the HTTP/tokenizer worker

Impact

Multipart uploads to /v1/audio/transcriptions are read fully into memory before any size validation, so concurrent large uploads exhaust memory and crash the HTTP/tokenizer worker. The serving process holds the GPU, so the crash takes the model replica offline and forces a reload - on large models that means minutes of cold start with the KV cache and weights re-staged. No authentication is involved, so any client that can reach the endpoint can repeat this at will. Confidentiality and integrity are unaffected; this is availability only.

Who can reach it

Anyone who can reach the SGLang HTTP endpoint, unauthenticated. SGLang exposes no auth of its own by default, so exposure depends entirely on whether the port sits behind a gateway - a pod-network-reachable endpoint means any tenant workload in the cluster can do this.

What to do

No fixed version is named in the record; the upstream issue (sgl-project/sglang#43709) tracks it. Until a release lands, cap request body size and concurrency at the proxy or ingress in front of SGLang and keep the endpoint off any tenant-reachable network. Picking up a fix is a container image bump and a restart of the serving process - the GPU is released and re-acquired, but no node drain or reboot is needed.

References

Related entries

• SGLang: compressed audio decodes without duration limits, exhausting worker memory and CPUCVE-2026-109226 · SGLang load_audio (audio_url / audio_data decoding, no duration or sample limit)High
• SGLang: full-resolution video decode before max_pixels clamp exhausts inference worker memoryCVE-2026-109227 · SGLang (Qwen-VL video preprocessing, preprocess_video in qwen_vl.py)High
• SGLang: client can override GLM-V video decode budget via video_url fields and exhaust worker memoryCVE-2026-109228 · SGLang (GLM-V video processing, client-supplied fps/max_frames limits in glm4v.py)High
• SGLang: NanoNemotronVL processor disables Pillow decompression-bomb limit process-wideCVE-2026-109229 · SGLang (NanoNemotronVLImageProcessor sets Pillow Image.MAX_IMAGE_PIXELS to None)High
• vLLM (MOSS-Audio multimodal processor cache, /tokenize endpoint): vLLM caches a processor object for every distinctCVE-2026-114052 · vLLM (MOSS-Audio multimodal processor cache, /tokenize endpoint)High
• vLLM: client-supplied multimodal processor parameters exhaust memory and kill the shared serverCVE-2026-114055 · vLLM (per-request mm_processor_kwargs in Isaac, InternVL, H2OVL multimodal processors)High