10 matches found
SUSE CVE-2026-109229
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAXIMAGEPIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic...
CVE-2026-109229
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAXIMAGEPIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic...
CVE-2026-109229
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAXIMAGEPIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic...
CVE-2026-109229 SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAXIMAGEPIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic...
EUVD-2026-97435
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAXIMAGEPIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic...
CVE-2026-109229 SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAXIMAGEPIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic...
CVE-2026-109229 SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAXIMAGEPIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic...
CVE-2026-109229
The SGLang framework, through version 0.5.21 , is vulnerable to a denial of service (DoS) condition. The root cause is located in the NanoNemotronVLImageProcessor component, which sets Image.MAX_IMAGE_PIXELS to None, thereby disabling Pillow decompression bomb protection process-wide. Remote atta...
PT-2026-110598
Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.22 Description A denial of service issue exists where the NanoNemotronVLImageProcessor disables Pillow decompression bomb protection process-wide by setting Image.MAX IMAGE PIXELS to None. This allows remote...
CVE-2026-109229: Improper Handling of Highly Compressed Data (Data Amplification)
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAXIMAGEPIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic...