CVE-2026-109225

SGLang versions up to and including 0.5.21 are vulnerable to an unbounded memory allocation vulnerability (CWE-770). An unauthenticated remote attacker can cause a Denial of Service (DoS) by uploading oversized files to the /v1/audio/transcriptions endpoint. The root cause is that concurrent larg...