CVE-2026-109226

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.22

Description A decompression amplification issue exists in the load audio() function. Remote attackers can cause a denial of service by submitting highly compressed audio files, such as small FLAC-encoded silence files, which are decoded without duration or sample limits. This process expands the files into massive PCM (Pulse Code Modulation) buffers, exhausting worker memory and CPU resources. The attack can be executed via the audio url or audio data inputs.

Recommendations Update SGLang to version 0.5.22 or later. As a temporary mitigation, restrict or validate the audio url and audio data inputs to prevent the submission of maliciously compressed files.