CVE-2026-109227

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.22

Description An unbounded memory allocation issue exists in the preprocess video function within qwen vl.py. The system decodes video frames at their full source resolution before applying max pixels limits. Remote attackers can exploit this by submitting high-resolution videos to the '/v1/chat/completions' endpoint on Qwen-VL deployments. Concurrent requests of this nature can exhaust worker memory, leading to a denial of service.

Recommendations Update SGLang to version 0.5.22 or later. As a temporary mitigation, restrict access to the '/v1/chat/completions' endpoint or limit the resolution of uploaded videos.