Database/AI/ML frameworks & serving
SGLang: client can override GLM-V video decode budget via video_url fields and exhaust worker memory
Impact
The request schema lets a caller supply fps, max_frames, max_tokens_per_frame and max_image_tokens inside the video_url object, and GLM-V processing honours them. Setting them arbitrarily high makes the server decode every frame of a high-resolution video at full size, exhausting worker memory. This is a resource budget the operator thought they controlled being handed to the client, so capacity planning on the node is meaningless against a hostile request. The serving process dies and the GPUs it held go idle until weights reload. Availability only.
Who can reach it
Anyone who can post a chat completion request with a video_url object to a GLM-V SGLang deployment. No authentication required where the endpoint is directly exposed.
What to do
No fixed version is given; versions through 0.5.21 are affected. Until upstream ships a fix, strip or clamp fps, max_frames, max_tokens_per_frame and max_image_tokens at the API gateway rather than trusting the server, and rate-limit multimodal requests. A code fix requires restarting the serving daemon and reloading model weights.
References
Related entries
- SGLang: NanoNemotronVL processor disables Pillow decompression-bomb limit process-wideCVE-2026-109229 · SGLang (NanoNemotronVLImageProcessor sets Pillow Image.MAX_IMAGE_PIXELS to None)High
- vLLM (MOSS-Audio multimodal processor cache, /tokenize endpoint): vLLM caches a processor object for every distinctCVE-2026-114052 · vLLM (MOSS-Audio multimodal processor cache, /tokenize endpoint)High
- vLLM: client-supplied multimodal processor parameters exhaust memory and kill the shared serverCVE-2026-114055 · vLLM (per-request mm_processor_kwargs in Isaac, InternVL, H2OVL multimodal processors)High
- KubeAI (Ollama engine controller): Injection in `ollamaStartupProbeScript()`CVE-2026-34940 · KubeAI (Ollama engine controller)High
- Xinference: model launch API executes attacker-supplied Python because trust_remote_code is always onCVE-2026-76841 · Xinference (Xorbits Inference) model loaders - trust_remote_codeHigh
- Coze Studio: any registered user gets code execution from a workflow code node by defaultCVE-2026-77934 · Coze Studio (workflow code node, unsandboxed python3 subprocess)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.