CVE-2026-109226
Deferred Deferred - Pending Action

Memory Exhaustion in SGLang via FLAC Decoding

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio_url or audio_data inputs that expand into massive PCM buffers, exhausting worker memory and CPU for denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109226
EUVD
EUVD-2026-97432

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sgl-project sglang 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SGLang through version 0.5.21 has a decompression amplification vulnerability in the load_audio function. Attackers can exploit this by sending highly compressed audio files, such as small FLAC-encoded silence files, through inputs like audio_url or audio_data. These files expand into very large PCM buffers during decoding, consuming excessive memory and CPU resources, leading to a denial of service.

Detection Guidance

Monitor for unusually high memory or CPU usage on systems running SGLang. Check for repeated requests to audio_url or audio_data endpoints with small FLAC files. Inspect logs for excessive memory allocation errors in SGLang processes.

Impact Analysis

This vulnerability can cause system slowdowns or crashes due to excessive memory and CPU usage. If exploited, it may disrupt services relying on SGLang, leading to downtime or degraded performance for applications processing audio files.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability. GDPR requires ensuring availability of processing systems, while HIPAA mandates safeguards against disruptions. Exploits causing memory exhaustion may violate these requirements by degrading or disabling systems handling sensitive data.

Mitigation Strategies

Upgrade SGLang to a version beyond 0.5.21. Implement strict input validation for audio files, rejecting excessively compressed FLAC files. Set memory and CPU usage limits for SGLang processes. Disable audio_url and audio_data inputs if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109226. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart