SGLang: compressed audio decodes without duration limits, exhausting worker memory and CPU

Impact

load_audio decodes submitted audio with no duration or sample-count ceiling, so a small FLAC file of silence expands into an enormous PCM buffer. A handful of such requests through audio_url or audio_data burn worker memory and CPU until the serving process dies, taking the GPU replica with it and forcing a model reload. This is a distinct code path from the unbounded upload buffering in CVE-2026-109225 - a request-size cap at the proxy does not stop it, because the request itself is tiny. Availability only; no data exposure.

Who can reach it

Any client that can submit a multimodal inference request to the SGLang endpoint, unauthenticated. The audio_url form also means the server will fetch and decode remote content, so the attacker does not have to upload anything.

What to do

No fixed version is named in the record. Until one ships, disable audio/multimodal endpoints if the deployment does not need them, or put a validating gateway in front that rejects audio beyond an accepted duration - a byte-size limit alone is not sufficient here. Applying a future fix is a container image bump and a restart of the serving process; no node drain or reboot.

References

Related entries

• SGLang: full-resolution video decode before max_pixels clamp exhausts inference worker memoryCVE-2026-109227 · SGLang (Qwen-VL video preprocessing, preprocess_video in qwen_vl.py)High
• SGLang: client can override GLM-V video decode budget via video_url fields and exhaust worker memoryCVE-2026-109228 · SGLang (GLM-V video processing, client-supplied fps/max_frames limits in glm4v.py)High
• SGLang: NanoNemotronVL processor disables Pillow decompression-bomb limit process-wideCVE-2026-109229 · SGLang (NanoNemotronVLImageProcessor sets Pillow Image.MAX_IMAGE_PIXELS to None)High
• vLLM (MOSS-Audio multimodal processor cache, /tokenize endpoint): vLLM caches a processor object for every distinctCVE-2026-114052 · vLLM (MOSS-Audio multimodal processor cache, /tokenize endpoint)High
• vLLM: client-supplied multimodal processor parameters exhaust memory and kill the shared serverCVE-2026-114055 · vLLM (per-request mm_processor_kwargs in Isaac, InternVL, H2OVL multimodal processors)High
• KubeAI (Ollama engine controller): Injection in `ollamaStartupProbeScript()`CVE-2026-34940 · KubeAI (Ollama engine controller)High