CVE-2026-109227

SGLang versions through 0.5.21 are vulnerable to an unbounded memory allocation vulnerability within the preprocess_video function in qwen_vl.py. The root cause is that the system decodes video frames at their full source resolution before applying max_pixels limits. A remote attacker can exploit...

EUVD-2026-97433

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocessvideo in qwenvl.py that decodes frames at full source resolution before applying maxpixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and...