CVE-2026-109229

The SGLang framework, through version 0.5.21 , is vulnerable to a denial of service (DoS) condition. The root cause is located in the NanoNemotronVLImageProcessor component, which sets Image.MAX_IMAGE_PIXELS to None, thereby disabling Pillow decompression bomb protection process-wide. Remote atta...

EUVD-2026-97435

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAXIMAGEPIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic...