SGLang: Denial of service via decompression bomb in image processor
Summary
SGLang through 0.5.21 disables Pillow's decompression-bomb protection process-wide when the NanoNemotron vision-language image processor is loaded. A remote attacker who can send images to the inference endpoint can submit small, highly compressed images with very large dimensions. Decoding these images can exhaust the worker memory and crash or stall the process.
Affected
- SGLang through 0.5.21 (sgl-project sglang, versions 0 to 0.5.21)
- Affected component: NanoNemotron vision-language image processor
Fixed in
- Unknown. No released version containing the fix has been confirmed.
- Fix proposal: pull request #43713 removes the global Image.MAX_IMAGE_PIXELS assignment; its merge status is not verified.
Workaround
- No vendor workaround is documented.
- Do not use NanoNemotron-based models on production hosts that accept images from untrusted users.
- Limit request size and worker memory, for example with container memory limits and automatic restarts.
- Keep the inference API off the public internet and behind authentication.
Exploitation
- CISA SSVC: exploitation status is proof of concept; automatable: yes; technical impact: partial.
- A public reproduction is described in the upstream issue and fix pull request.
- Not listed in CISA's Known Exploited Vulnerabilities catalogue.
- No reports of in-the-wild exploitation of this CVE were found.
Our recommendation
- Inventory all SGLang deployments and check whether they are reachable from the internet or untrusted users.
- Place SGLang instances behind authentication and restrict network access.
- Monitor memory use and restarts of inference workers.
- Upgrade to a fixed release once the vendor confirms it; check the SGLang releases page.
- Treat internet-reachable instances as medium to high risk and isolated internal instances as low risk.
- NVD CVSS 3.1 score is 7.5; CVSS 4.0 score is 8.7. NVD status is listed as Deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- SGLang GitHub repository github.com
- SGLang issue 43707 github.com
- SGLang pull request 43713 github.com
- VulnCheck advisory www.vulncheck.com
- OSV record CVE-2026-109229 osv.dev
- OpenCVE record CVE-2026-109229 app.opencve.io
- PSIRT record CVE-2026-109229 psirt.com
- Snyk record SNYK-PYTHON-SGLANG-15470991 security.snyk.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:52.
Original description (NVD)
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic image loader, exhausting worker memory during decoding.
NVD references (6)
- https://github.com/sgl-project/sglang
- https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/multimodal/processors/nano_nemotron_vl.p…
- https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/utils/common.py#L1952-L1961
- https://github.com/sgl-project/sglang/issues/43707
- https://www.vulncheck.com/advisories/sglang-through-0.5.21-decompression-bomb-dos-via-nanonemotronvlimageproc…
- https://github.com/sgl-project/sglang/issues/43707
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.