CVE-2026-109225 SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before...

CVE-2026-109225

SGLang versions up to and including 0.5.21 are vulnerable to an unbounded memory allocation vulnerability (CWE-770). An unauthenticated remote attacker can cause a Denial of Service (DoS) by uploading oversized files to the /v1/audio/transcriptions endpoint. The root cause is that concurrent larg...

CVE-2026-109225 SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before...