CVE-2026-109228

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.22

Description A resource budget bypass allows remote attackers to override GLM-V video processing limits. By providing specific values in the video url object, attackers can manipulate the fps, max frames, max tokens per frame, and max image tokens variables. This causes the glm4v.py function to decode every frame of high-resolution video at full size, leading to worker memory exhaustion and a denial of service.

Recommendations Update SGLang to version 0.5.22 or later.