SGLang CVE-2026-109225

Exploitation requires that the target run SGLang (through 0.5.21) with its HTTP server exposing the /v1/audio/transcriptions endpoint reachable by the attacker; the endpoint accepts multipart file uploads without authentication (PR:N/UI:N) and buffers the entire uploaded file into memory before performing size validation, so sending concurrent oversized uploads triggers memory exhaustion. The practical limiting factors are network exposure (the SGLang API must be reachable rather than bound to localhost or firewalled) and the availability-only impact - successful attacks crash the worker and deny service but do not compromise data or allow code execution, and the service can be restarted.

All signals point to a genuine but impact-limited availability threat. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated attack with no user interaction, and the impact metrics (VC:N/VI:N/VA:H) correctly scope this as pure denial-of-service with no confidentiality or integrity loss - consistent with the CWE-770 (unbounded resource allocation) classification and the description of memory exhaustion crashing the HTTP/tokenizer worker. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the finding originates from VulnCheck research with a vendor/advisory reference and an upstream GitHub issue, not from observed attacks. The 8.7 base score is driven entirely by the ease of triggering a service outage, not by any code-execution or data-exposure risk. Net assessment: a real, easily-reproduced DoS priority for anyone exposing SGLang's audio transcription endpoint to untrusted networks, but materially lower urgency than a comparably-scored RCE or data-breach flaw because the worst case is a recoverable crash. No conflicting signals were detected; the main gap is the absence of exploitation-probability (EPSS) and in-the-wild data.

An attacker who can reach an exposed SGLang server (through 0.5.21) sends multiple concurrent large multipart file uploads to the unauthenticated /v1/audio/transcriptions endpoint. Because each oversized file is fully read into memory before any size validation, the server's memory is exhausted and the HTTP/tokenizer worker crashes, denying service to legitimate users. No public exploit code was identified in the provided data, but the attack requires only a standard HTTP client and no authentication.