CVE-2026-109227 sgl-project CVE debrief

Who should care

Defenders responsible for SGLang deployments, particularly those using Qwen-VL, should assess their exposure to untrusted video inputs and verify the version of SGLang in use. This vulnerability may impact systems that process video inputs from untrusted sources.

Why it matters

CVE-2026-109227 is a memory exhaustion denial-of-service vulnerability in SGLang through version 0.5.21. It affects Qwen-VL deployments and allows remote attackers to cause denial of service by submitting high-resolution videos. Defenders should verify exposure, assess upgrade feasibility, and implement input validation and rate limiting.

• Denial of service through memory exhaustion
• Potential for system crashes or instability
• Need for input validation and rate limiting
• Verification of SGLang version and configuration

Technical summary

The vulnerability exists in the preprocess_video function of qwen_vl.py in SGLang through version 0.5.21. It allows for unbounded memory allocation by decoding frames at full source resolution before applying max_pixels limits. This can be exploited by remote attackers submitting high-resolution videos to /v1/chat/completions on Qwen-VL deployments, leading to denial of service through memory exhaustion.

Defensive priority

Defenders should prioritize verifying exposure of SGLang deployments to untrusted video inputs and assess the feasibility of upgrading to a fixed version.

Recommended defensive actions

• Verify SGLang deployment versions and configurations to identify potential exposure
• Assess the feasibility of upgrading to a fixed version of SGLang
• Implement input validation and limits for video processing to prevent memory exhaustion
• Monitor for concurrent requests and implement rate limiting if necessary
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to technical descriptions and issue tracking. Defenders should verify the version of SGLang in use, assess exposure to untrusted video inputs, and implement input validation and rate limiting. The preprocess_video function in qwen_vl.py decodes frames at full source resolution before applying max_pixels limits, allowing for unbounded memory allocation. This can be exploited by remote attackers submitting高清.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.