CVE-2026-109226 — SGLang through 0.5.21 Audio Decompression Amplification via load_audio
SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio dec…
Published: 2026-10-12 · CVSS: 8.7 · CVSS 4.0
SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio_url or audio_data inputs that expand into massive PCM buffers, exhausting worker memory and CPU for denial of service.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7