Database/AI/ML frameworks & serving
SGLang: NanoNemotronVL processor disables Pillow decompression-bomb limit process-wide
Impact
NanoNemotronVLImageProcessor sets Image.MAX_IMAGE_PIXELS to None, which is a process-global Pillow setting, so decompression-bomb protection is removed for the generic image loader too - not just for the model that asked for it. A small, highly compressed image declaring huge dimensions then expands to many gigabytes during decode and the worker runs out of memory. Loading one such model into a shared SGLang process therefore weakens every image path in it. Availability only; the GPU worker has to be restarted and model weights reloaded.
Who can reach it
Anyone who can submit an image to an affected SGLang deployment's image loader. No authentication required where the endpoint is exposed directly.
What to do
No fixed version is named; versions through 0.5.21 are affected. Track sgl-project/sglang#43707. Mitigate by rejecting oversized image dimensions and request bodies at the gateway before they reach the server. A fix means restarting the serving daemon.
References
Related entries
- vLLM (MOSS-Audio multimodal processor cache, /tokenize endpoint): vLLM caches a processor object for every distinctCVE-2026-114052 · vLLM (MOSS-Audio multimodal processor cache, /tokenize endpoint)High
- vLLM: client-supplied multimodal processor parameters exhaust memory and kill the shared serverCVE-2026-114055 · vLLM (per-request mm_processor_kwargs in Isaac, InternVL, H2OVL multimodal processors)High
- KubeAI (Ollama engine controller): Injection in `ollamaStartupProbeScript()`CVE-2026-34940 · KubeAI (Ollama engine controller)High
- Xinference: model launch API executes attacker-supplied Python because trust_remote_code is always onCVE-2026-76841 · Xinference (Xorbits Inference) model loaders - trust_remote_codeHigh
- Coze Studio: any registered user gets code execution from a workflow code node by defaultCVE-2026-77934 · Coze Studio (workflow code node, unsandboxed python3 subprocess)High
- Ollama: model pull follows cross-host redirects, giving SSRF to internal and metadata endpointsCVE-2026-85180 · Ollama (tensor-layer blob download, cross-host redirect handling)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.