SGLang: Unbounded memory allocation in Qwen-VL video processing

Summary

SGLang up to and including version 0.5.21 allocates memory for video frames at full source resolution before the max_pixels limit is applied in the Qwen-VL video preprocessing. A remote attacker can send high-resolution videos to the /v1/chat/completions endpoint. Concurrent requests can exhaust the memory of the worker and cause a denial of service.

Affected

• SGLang versions 0 to 0.5.21 (per CVE record and OSV)
• Only deployments serving Qwen-VL models with video input are affected by the vulnerable code path
• Default authentication behaviour: Unknown.

Fixed in

• Unknown. The vendor has not confirmed a fixed version in the sources reviewed.
• A VulnCheck-derived source states 0.5.22 or later, but this could not be verified against the VulnCheck advisory.
• OSV lists a fixing commit (e00930c5489053f26d86b179cee0d087f846acbb).

Workaround

• Limit the size and frequency of video inputs until the upgrade is completed.
• If video input is not needed, do not serve the Qwen-VL video path.
• Keep the inference endpoint off the public internet and place it behind an authenticated reverse proxy with rate limits.
• Apply memory limits to the worker processes.

Exploitation

• VulDB lists no exploit.
• CISA SSVC assessment: exploitation status 'poc', automatable: yes, technical impact: partial.
• No evidence of exploitation in the wild was found. No CISA KEV listing was verified.

Our recommendation

• Check whether SGLang with Qwen-VL models is used in your environment, including internal AI services.
• If it is in use and reachable from the internet or from many users, upgrade to a release that contains the fixing commit and confirm this against the vendor's release notes.
• Restrict access to the inference endpoint and monitor memory usage and request volume on the worker.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• SGLang GitHub repository github.com
• Upstream issue 43710 github.com
• qwen_vl.py at v0.5.21 github.com
• VulnCheck advisory www.vulncheck.com
• OSV entry CVE-2026-109227 osv.dev
• VulDB 416937 vuldb.com
• Rapid7 via Vulners vulners.com
• sglang on PyPI pypi.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:54.