CVE-2026-109228
Deferred Deferred - Pending Action

SGLang Video Processing Resource Bypass via fps and Frame Limits

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_tokens_per_frame and max_image_tokens in the video_url object. Attackers can set these values arbitrarily high so glm4v.py decodes every frame of high-resolution video at full size, exhausting worker memory and denying service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109228
EUVD
EUVD-2026-97434

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sgl-project sglang 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SGLang through version 0.5.21 has a vulnerability that lets remote attackers bypass resource limits for video processing. By manipulating parameters like fps, max_frames, max_tokens_per_frame, and max_image_tokens in the video_url object, attackers can set these values to extremely high numbers. This causes the system to decode every frame of high-resolution videos at full size, consuming excessive worker memory and leading to service denial.

Detection Guidance

Monitor for unusually high memory usage during video processing tasks. Check logs for requests containing video_url objects with abnormally high fps, max_frames, max_tokens_per_frame, or max_image_tokens values. Inspect network traffic for large video file transfers to SGLang endpoints.

Impact Analysis

This vulnerability can cause system crashes or slowdowns due to excessive memory usage. If exploited, it may disrupt video processing services, leading to downtime or degraded performance. Organizations using SGLang for video processing could face operational disruptions and potential financial losses from service unavailability.

Compliance Impact

This vulnerability could lead to denial-of-service conditions by exhausting system resources, which may violate compliance requirements for availability in standards like GDPR (Article 32) and HIPAA (Security Rule). Uncontrolled memory usage could also risk unauthorized data exposure if exploited to crash systems handling sensitive data.

Mitigation Strategies

Upgrade SGLang to a version beyond 0.5.21. Implement input validation to reject video_url objects with excessive fps, max_frames, max_tokens_per_frame, or max_image_tokens values. Set server-side limits for these parameters to prevent resource exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109228. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart