EUVD-2026-97433
GHSA-6h2g-h3jf-2prp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed /v1/chat/completions endpoint
-
DeliverySubmit high-resolution video payload
-
ExploitFull-resolution decode bypasses max_pixels limit
-
ExecutionIssue concurrent requests
-
PersistExhaust worker memory
-
ImpactDenial of service on inference server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an SGLang deployment (through 0.5.21) serving a Qwen-VL multimodal model with the /v1/chat/completions endpoint accepting video input, where preprocess_video in qwen_vl.py decodes frames at full source resolution before max_pixels downscaling. Exploitation is amplified by concurrent requests, so a single request may be insufficient; effectiveness scales with the server's memory headroom and any request-size/rate limits. The primary limiting factor is exposure of the inference endpoint: if /v1/chat/completions is authenticated, rate-limited, behind a gateway, or only internally reachable, the PR:N/unauthenticated assumption no longer holds and realistic risk drops sharply. |
| Impact | This is a genuine availability-impact issue rather than an inflated high-CVSS finding, but its real-world priority is moderate and tightly scoped. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack whose entire impact is availability (VA:H; VC:N/VI:N), consistent with CWE-770 unbounded resource allocation - there is no confidentiality or integrity exposure and no code execution. The vendor-assigned 8.7 reflects 4.0's heavier weighting of a clean remote-unauth DoS; a CVSS 3.1 equivalent lands around 7.5, so the headline number is somewhat elevated by the scoring version rather than by severity of outcome. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation is not demonstrated in the wild. No public exploit identified at time of analysis. The PR:N claim assumes the /v1/chat/completions endpoint is exposed without authentication, which is deployment-dependent - many SGLang/Qwen-VL deployments sit behind API gateways or internal networks, which materially limits realistic exposure. Net: treat as a patch-soon hardening item for internet-exposed Qwen-VL video inference, not an emergency. |
| Exploit ScenarioDerived | An attacker with network access to a Qwen-VL deployment served by SGLang sends chat-completion requests containing very high-resolution video payloads, which preprocess_video decodes at full source resolution before max_pixels downscaling is applied. By issuing several such requests concurrently, the attacker inflates per-request memory far beyond configured limits and exhausts the inference worker's memory, crashing or stalling the service. No public exploit code was identified, but the technique is straightforward given the documented code path (qwen_vl.py lines 267-306). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Denial of service in SGLang through 0.5.21 lets remote attackers exhaust worker memory by submitting high-resolution video content to the OpenAI-compatible /v1/chat/completions endpoint on Qwen-VL multimodal deployments, with concurrent requests multiplying the allocation until the inference worker or host runs out of RAM. The root cause is preprocess_video in python/sglang/srt/multimodal/processors/qwen_vl.py (lines 267-306), which decodes every frame at full source resolution before the max_pixels downscaling limit is applied, so the documented memory cap does not constrain the expensive decode step. Severity is rated CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, C/I integrity unaffected) and the assessed CVSS 3.1 equivalent is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); no public exploit identified at time of analysis, no CISA KEV listing, and real-world priority is moderate and tightly scoped because the practical limiting factor is exposure of the inference endpoint rather than exploitation difficulty.
RemediationAI
No vendor-released patch was identified in the available data at time of analysis; the upstream tracking reference is GitHub issue 43710 (https://github.com/sgl-project/sglang/issues/43710) and the vendor advisory is https://www.vulncheck.com/advisories/sglang-through-0.5.21-memory-exhaustion-dos-via-qwen-vl-video-preprocessing, so monitor those for a fixed release and upgrade to any SGLang version published after 0.5.21 that clamps resolution before decoding. Until then, apply pre-decode controls rather than relying on max_pixels, which is applied after full-resolution framing and therefore does not mitigate. Front the inference server with a reverse proxy or API gateway that enforces a hard request body size limit (e.g., a few megabytes) and rejects oversized video payloads before they reach the worker - trade-off: legitimate long or high-resolution videos will be rejected and need an out-of-band upload path. Clamp video resolution/duration upstream with an ffmpeg/transcoding step or a validation hook that only forwards content within a known pixel and frame budget - trade-off: added preprocessing latency and infrastructure. Cap concurrency on the video path with per-client rate limits plus a bounded request queue so a burst of video requests cannot allocate buffers in parallel - trade-off: queuing latency and possible timeouts for all clients, not just abusive ones. Run SGLang workers under cgroup/container memory limits with OOM-kill and automatic restart so a memory blowup terminates only the worker process instead of the host - trade-off: brief unavailability and loss of in-flight requests. Restrict access to /v1/chat/completions to trusted clients using API-key authentication and network ACLs; note that doing so invalidates the PR:N (unauthenticated) assumption in the assessed vector and sharply reduces realistic risk. If video input is not required, disable video handling in the Qwen-VL processor or reject video content types at the gateway entirely.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SGLang is an open-source serving framework (sgl-project/sglang) for large language and multimodal models, exposing an OpenAI-compatible HTTP API. The vulnerable component is the Qwen-VL multimodal processor: preprocess_video in python/sglang/srt/multimodal/processors/qwen_vl.py decodes the incoming video into raw frames at the full source resolution and only afterwards applies the max_pixels constraint intended to bound visual token/resolution cost. Because frame buffers scale with width x height x channels x frame count, a single 4K or long-duration video can allocate hundreds of megabytes to multiple gigabytes on the CPU side of the worker before any downscaling occurs; repeated or concurrent /v1/chat/completions video requests allocate these buffers in parallel. This is CWE-770 (Allocation of Resources Without Limits or Throttling), i.e., missing pre-decode resource bounds rather than a memory-safety bug; there is no corruption or code-execution primitive, only resource exhaustion (OOM kill of the worker/scheduler or severe service degradation). Affected code is confined to deployments serving Qwen-VL family multimodal models (Qwen2-VL/Qwen2.5-VL) with video input enabled, as identified by CPE cpe:2.3:a:sgl-project:sglang:*:*:*:*:*:*:*:* and the v0.5.21 source reference.
Know when Sglang gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote, low-complexity resource-exhaustion reachable via the chat endpoint with no auth or interaction assumed; impact is availability only, so C:N/I:N/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and concurrent requests exhaust worker memory causing denial of service.
Executive ViewAI
SGLang deployments through 0.5.21 that serve Qwen-VL multimodal models are exposed to an unauthenticated remote denial-of-service condition that can exhaust inference worker or host memory and disrupt AI services. No vendor-released patch identified at time of analysis, and because the OpenAI-compatible /v1/chat/completions endpoint can be reached remotely, leadership should treat exposed services as an availability risk until access is constrained or a fix is released. The impact is primarily service outage and degraded customer-facing AI capabilities, not data confidentiality or integrity loss.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to the OpenAI-compatible /v1/chat/completions endpoint on SGLang deployments with Qwen-VL, disabling video/multimodal input if not needed, enforcing strict request-body/video-size and resolution limits at a reverse proxy, capping concurrent requests, applying worker memory limits and automatic restart/isolation, and monitoring for memory exhaustion.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote attackers can crash the SGLang inference server (versions up to and including 0.5.19) by calling
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code b
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe
Remote code execution in SGLang AI inference servers allows unauthenticated attackers to run arbitrary code through the
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the op
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, wh
Unauthenticated remote code execution in SGLang versions through v0.5.20 arises from unsafe pickle deserialization in th
Unauthenticated remote code execution in SGLang 0.5.11 through 0.5.14 occurs when the multimodal generation runtime is l
Exploit-DB