CVE-2026-109228

SGLang versions through 0.5.21 are vulnerable to a resource budget bypass in the GLM-V video processing logic. By supplying arbitrary values for fps, max_frames, max_tokens_per_frame, and max_image_tokens within the video_url object, a remote attacker can force glm4v.py to decode every frame of a...

EUVD-2026-97434

SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, maxframes, maxtokensperframe and maximagetokens in the videourl object. Attackers can set these values arbitrarily high so glm4v.py decode...