SGLang CVE-2026-109228

Exploitation requires the target SGLang instance (version ≤0.5.21) to be serving a GLM-4V (GLM-V) multimodal model and to accept video_url inputs, because the flaw is specific to the glm4v.py video-processing path that trusts client-supplied fps, max_frames, max_tokens_per_frame, and max_image_tokens fields instead of enforcing server-side budgets. The attacker must be able to reach the inference API endpoint and submit these parameters in the video_url object; per CVSS PR:N no authentication is required by the base vector, though in practice the endpoint is often fronted by a proxy or network boundary. Limiting factors: deployments not serving GLM-4V, not enabling video input, or upgraded past 0.5.21 are not affected; impact is denial of service only (no code execution or data exposure).

All available signals point to a genuine availability risk but not a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction, and impact is confined to availability (VA:H; VC:N/VI:N - no confidentiality or integrity loss), consistent with CWE-770 uncontrolled resource consumption and the 'Denial Of Service' tag. The 8.7 score is driven almost entirely by the ease of reaching the endpoint plus high availability impact, not by any code-execution or data-exposure potential. No EPSS score, SSVC decision, KEV listing, or POC indicator is present in the input, so exploitation probability and automatability cannot be quantified from the data. There is no CISA KEV entry (not actively exploited per available data) and no public exploit identified at time of analysis, so this is a credible-but-prioritize-by-exposure issue rather than a confirmed in-the-wild threat. Important scoping caveat: the PR:N rating assumes the SGLang inference endpoint is reachable without authentication; in production SGLang is frequently deployed behind an API gateway, reverse proxy, or internal network boundary, which would raise the practical barrier even though the base vector says PR:N.

An attacker with network access to an SGLang server hosting a GLM-4V vision model submits a chat/completions request containing a video_url object with fps, max_frames, max_tokens_per_frame, and max_image_tokens set to extreme values. Because glm4v.py honors these client-supplied limits instead of enforcing server-side caps, the worker decodes every frame of a high-resolution video at full resolution, exhausting memory and crashing or hanging the worker, denying service to legitimate users. No public exploit code is identified at time of analysis, but the attack requires only a crafted JSON request against a documented API field.