Database/AI/ML frameworks & serving
SGLang: full-resolution video decode before max_pixels clamp exhausts inference worker memory
Impact
An unauthenticated caller to a Qwen-VL deployment can submit a high-resolution video and SGLang decodes every frame at source resolution before applying the max_pixels limit, so the memory spike happens before any budget is enforced. Concurrent requests push the worker out of memory and the serving process dies, taking the GPUs it had pinned with it. On a GPU node this is expensive to absorb: the model weights have to be reloaded into HBM on restart, and a shared endpoint fronting several tenants loses service for all of them. No confidentiality or integrity impact is claimed, availability only.
Who can reach it
Anyone who can reach the /v1/chat/completions endpoint of a Qwen-VL SGLang deployment. No authentication is required if the endpoint is exposed without a gateway in front of it.
What to do
No fixed version is named in the record - versions through 0.5.21 are affected. Track the upstream issue (sgl-project/sglang#43710). Until a fix lands, mitigate in front of the server: cap request body size and video resolution at the gateway, limit concurrency per client, and keep multimodal endpoints off untrusted networks. Applying a fix means restarting the serving daemon, which reloads model weights.
References
Related entries
- SGLang: client can override GLM-V video decode budget via video_url fields and exhaust worker memoryCVE-2026-109228 · SGLang (GLM-V video processing, client-supplied fps/max_frames limits in glm4v.py)High
- SGLang: NanoNemotronVL processor disables Pillow decompression-bomb limit process-wideCVE-2026-109229 · SGLang (NanoNemotronVLImageProcessor sets Pillow Image.MAX_IMAGE_PIXELS to None)High
- vLLM (MOSS-Audio multimodal processor cache, /tokenize endpoint): vLLM caches a processor object for every distinctCVE-2026-114052 · vLLM (MOSS-Audio multimodal processor cache, /tokenize endpoint)High
- vLLM: client-supplied multimodal processor parameters exhaust memory and kill the shared serverCVE-2026-114055 · vLLM (per-request mm_processor_kwargs in Isaac, InternVL, H2OVL multimodal processors)High
- KubeAI (Ollama engine controller): Injection in `ollamaStartupProbeScript()`CVE-2026-34940 · KubeAI (Ollama engine controller)High
- Xinference: model launch API executes attacker-supplied Python because trust_remote_code is always onCVE-2026-76841 · Xinference (Xorbits Inference) model loaders - trust_remote_codeHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.