SGLang: Resource budget bypass in GLM-V video processing enables denial of service
Summary
SGLang through 0.5.21 lets remote attackers override the GLM-V video processing limits (fps, max_frames, max_tokens_per_frame, max_image_tokens) by supplying them in the video_url object of a request. With values set arbitrarily high, the server decodes every frame of a high-resolution video at full size, which can exhaust worker memory and deny service. The risk mainly applies to GLM-V models served through this processor path and is highest for internet-facing or shared endpoints.
Affected
- SGLang through 0.5.21 (OSV lists 0.5.21 as the last affected version)
- Deployments serving GLM-V video models through the glm4v processor
Fixed in
- Pull request #43871 clamps request video budgets to the deployment limit
- Fixed release: Unknown. Check the release notes or PR #43871 before choosing a version to upgrade to.
Workaround
- No official workaround found.
- Place a gateway in front of the service that enforces request and media size limits and restricts access to trusted clients.
- Set container memory limits so that one worker cannot take down the host.
Exploitation
- Exploited in the wild: Unknown. Not listed in CISA KEV.
- Public exploit: None confirmed.
- EPSS: 0.00493 (low).
- CISA SSVC: Automatable yes, technical impact partial.
Our recommendation
- Check whether SGLang with GLM-V models is in use and whether the endpoint is reachable from untrusted networks.
- Upgrade to a release that includes the fix from PR #43871 once its version is confirmed.
- Until patched, restrict access, apply gateway limits and set memory limits.
- Monitor worker memory usage and restarts for signs of exhaustion.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OSV: CVE-2026-109228 osv.dev
- VulnCheck advisory www.vulncheck.com
- SGLang issue #43705 github.com
- SGLang pull request #43871 github.com
- SGLang protocol.py at v0.5.21 github.com
- VulDB entry 416938 vuldb.com
- Vulners RAPID7 record vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:51.
Original description (NVD)
SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_tokens_per_frame and max_image_tokens in the video_url object. Attackers can set these values arbitrarily high so glm4v.py decodes every frame of high-resolution video at full size, exhausting worker memory and denying service.
NVD references (7)
- https://github.com/sgl-project/sglang
- https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/entrypoints/openai/protocol.py#L592-L594
- https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/multimodal/processors/glm4v.py#L160-L167
- https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/multimodal/processors/glm4v.py#L400
- https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/parser/conversation.py#L691
- https://github.com/sgl-project/sglang/issues/43705
- https://www.vulncheck.com/advisories/sglang-through-0.5.21-resource-budget-bypass-via-glm-v-video-parameters
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.