CVE-2026-109225

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.22

Description An unbounded memory allocation issue exists that allows unauthenticated remote attackers to cause a denial of service. By uploading oversized files to the '/v1/audio/transcriptions' endpoint, attackers can send concurrent large multipart uploads that are read entirely into memory before validation, resulting in a crash of the HTTP/tokenizer worker.

Recommendations Update SGLang to version 0.5.22 or later. As a temporary mitigation, restrict access to the '/v1/audio/transcriptions' endpoint.