SGLang: Unbounded memory allocation via audio transcription upload causes DoS
Summary
SGLang through 0.5.21 reads entire multipart uploads to /v1/audio/transcriptions into memory before validating them. An unauthenticated remote attacker can send concurrent oversized uploads to exhaust memory and crash the HTTP or tokenizer worker. The issue affects any reachable SGLang deployment with the transcription endpoint enabled and no request-size limit in front of it.
Affected
- SGLang through 0.5.21 (sgl-project/sglang)
- OSV gives no release version; the affected range ends before commit e00930c5489053f26d86b179cee0d087f846acbb
Fixed in
Unknown. A fix is proposed in pull request #43915 (adds a maximum upload size option, proposed default 25 MiB), but its merge status and first fixed release could not be confirmed.
Workaround
- Enforce a request-body size limit at a reverse proxy in front of the transcription endpoint
- Do not expose the SGLang API directly to the internet; restrict access to trusted networks
- Disable or restrict the /v1/audio/transcriptions route if it is not needed
- Monitor memory use and worker restarts
Exploitation
- CISA SSVC: exploitation none, automatable yes
- VulDB: no exploit available
- Not listed in CISA KEV; no public exploitation reports found
- EPSS 0.00428 (Rapid7)
Our recommendation
- Check whether any SGLang instance runs version 0.5.21 or earlier and whether it is reachable from outside
- Place a body-size limit in front of the transcription route now
- Do not close the item until sgl-project confirms a fixed release or PR #43915 is merged; then upgrade
- Monitor memory and worker restarts
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- SGLang GitHub repository github.com
- SGLang issue #43709 github.com
- VulnCheck advisory www.vulncheck.com
- SGLang pull request #43915 github.com
- OSV CVE-2026-109225 osv.dev
- VulDB 416941 vuldb.com
- OpenCVE CVE-2026-109225 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:53.
Original description (NVD)
SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before validation, to crash the HTTP/tokenizer worker and deny service.
NVD references (4)
- https://github.com/sgl-project/sglang
- https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/entrypoints/http_server.py#L1847-L1871
- https://github.com/sgl-project/sglang/issues/43709
- https://www.vulncheck.com/advisories/sglang-through-0.5.21-memory-exhaustion-dos-via-v1-audio-transcriptions-…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.