SGLang CVE-2026-109226

The target SGLang instance (<=0.5.21) must be deployed serving an audio-capable multimodal model and must accept attacker-supplied audio via the audio_url or audio_data inputs, since load_audio performs no duration or sample-count limiting during decode. Exploitation is otherwise unrestricted: CVSS PR:N/UI:N and the endpoint is typically unauthenticated, so no credentials or user interaction are needed. The principal limiting factor is configuration-based exposure - SGLang deployments that serve only text models, or that place the inference endpoint behind authentication/network restrictions or request-size/resource limits, are not exploitable via this path.

Signals point to a genuine but bounded availability risk. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, everything else N) scores 8.7 and is internally consistent with the description: a remote, unauthenticated, low-complexity denial-of-service with no confidentiality or integrity impact. My independent CVSS 3.1 mapping yields 7.5 (A:H only), so the headline 8.7 reflects CVSS 4.0's weighting rather than any confidentiality/integrity exposure - this is a pure DoS, not RCE. No EPSS score, SSVC decision, KEV listing, or POC is present in the input, so exploitation likelihood cannot be quantified; per precision rules this is 'no public exploit identified at time of analysis.' The amplification nature (small FLAC silence → massive PCM buffer) makes exploitation cheap and automatable in principle, which raises practical concern, but the absence of any exploitation evidence and the requirement that the target actually expose audio multimodal inference tempers it. Net: a real priority for operators running SGLang audio-serving endpoints exposed to untrusted input, but a lower priority than the 8.7 might suggest for the majority of SGLang deployments that do not accept audio.

An attacker locates an internet-reachable SGLang server configured to serve an audio-capable multimodal model and submits a tiny, highly compressed FLAC file of silence via the audio_url or audio_data input. load_audio decodes it without duration or sample limits, expanding it into an enormous PCM buffer that consumes worker memory and CPU; repeating the request starves the service and denies availability. No public exploit code was identified, but the attack requires no authentication and only low complexity (AV:N/AC:L/PR:N).