EUVD-2026-97435
GHSA-fqvf-j3pr-77v9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed SGLang image endpoint
-
ExploitSubmit tiny highly-compressed huge-dimension image
-
ExecutionGeneric loader decodes unbounded bitmap
-
ImpactWorker memory exhausted, service denial
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Compression ratio limits
|
| Exploitation Conditions | Exploitation requires an SGLang server (≤0.5.21) that loads NanoNemotronVLImageProcessor, which sets Pillow's Image.MAX_IMAGE_PIXELS to None and thereby removes decompression-bomb protection for the entire worker process, affecting even the generic image loader. The attacker must be able to reach an endpoint that accepts attacker-supplied images for decoding. Given CVSS PR:N/UI:N, no authentication or user interaction is confirmed necessary, so any network-reachable instance serving that image path is exposed. The principal limiting factor is deployment-specific: instances that do not serve a model using this processor (and thus never disable the pixel guard) are not affected, which narrows real-world exposure to multimodal/Nemotron-VL style configurations. |
| Impact | This is a genuine but bounded availability risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, unauthenticated, low-complexity attack, and the impact is scoped purely to availability (VA:H) with no confidentiality or integrity impact (VC:N/VI:N) - consistent with a denial-of-service memory-exhaustion bug (CWE-409, data amplification) rather than code execution. The 8.7 'High' score is driven entirely by easy reachability plus total availability loss, so the real-world priority depends heavily on whether the affected code path is actually loaded. No EPSS score was provided and the issue is NOT in CISA KEV, so there is no evidence of active exploitation; no public exploit code is referenced either. The signals are therefore internally consistent (network DoS, no exploitation data) - this is a credible patch-soon issue for exposed SGLang inference servers, not a drop-everything emergency. Key limiting nuance: the flaw is triggered by the NanoNemotronVLImageProcessor disabling Pillow's MAX_IMAGE_PIXELS guard process-wide, which realistically requires a deployment serving a model that uses that processor - verify applicability against your model configuration. |
| Exploit ScenarioDerived | An attacker sends small, highly compressed images (decompression bombs) with enormous declared pixel dimensions to the image-ingest endpoint of an internet-exposed SGLang server running a multimodal model that loads NanoNemotronVLImageProcessor. Because the processor sets Image.MAX_IMAGE_PIXELS to None process-wide, the generic image loader attempts to decode the full uncompressed bitmap, exhausting worker memory and crashing or hanging the serving process. No public exploit code is identified at time of analysis, but the technique (Pillow decompression bombs) is well known and trivial to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Memory-exhaustion denial of service in SGLang (all versions through 0.5.21) allows remote, unauthenticated attackers to crash inference workers by submitting small, highly compressed images with enormous pixel dimensions to the image loader. The root cause is that NanoNemotronVLImageProcessor sets Pillow's Image.MAX_IMAGE_PIXELS to None, a process-wide global that disables decompression-bomb protection for the entire worker, including the generic image-loading path used by other models. Per the independent assessment this is a genuine but bounded availability risk: it only affects deployments that actually load NanoNemotronVLImageProcessor, and there is no public exploit identified at time of analysis. EPSS and CISA KEV data were not provided, so active exploitation is not confirmed.
RemediationAI
No vendor-released patch or fixed version is identified in the available data; the upstream GitHub issue (https://github.com/sgl-project/sglang/issues/43707) is the tracking reference, so treated as an open fix and verify against the project's releases before assuming a version is safe. The most effective compensating control is to avoid loading NanoNemotronVLImageProcessor: do not serve NanoNemotron-VL models on internet-reachable SGLang instances, or patch the processor locally so the pixel guard is not mutated globally (e.g. restore Image.MAX_IMAGE_PIXELS to a sane value after any per-call override, or scope the override to a context that resets it), with the trade-off that some very large legitimate inputs may then be rejected. As defense in depth, re-enable and enforce Pillow's default guard on the generic loader path in python/sglang/srt/utils/common.py, and add an explicit pre-decode dimension/pixel-count check (reject images whose header dimensions exceed a configured ceiling) at the ingestion endpoint, accepting that overly strict limits can break legitimate high-resolution uploads. Additionally, restrict network access to image-accepting endpoints to trusted clients or place them behind an authenticated reverse proxy (PR:N means this is not currently required by the code, so this is an added layer with operational cost), and cap worker memory with container or cgroup limits plus automatic restart so a successful bomb triggers a fast, contained worker recycle rather than host-wide memory pressure; note that per-worker isolation increases memory overhead and the blast radius shifts to availability of that replicas' requests. Rate-limiting or queuing image submissions reduces repetition of the attack but does not prevent a single large submission from succeeding.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability maps to CWE-409 (Improper Handling of Highly Compressed Data, i.e. 'decompression bomb'). Pillow (PIL) ships a built-in safety guard: the module-level constant Image.MAX_IMAGE_PIXELS, which raises a DecompressionBombWarning/DecompressionBombError when an image's pixel count is excessive relative to its compressed size. The affected code, in python/sglang/srt/multimodal/processors/nano_nemotron_vl.py (line 82 of the v0.5.21 tree), assigns Image.MAX_IMAGE_PIXELS = None during image preprocessing for the NanoNemotron-VL multimodal model. Because this is a mutation of a shared module global rather than an instance-scoped or per-call setting, the protection is removed for every subsequent Pillow decode inside the same worker process. The generic image loader implemented in python/sglang/srt/utils/common.py (lines 1952-1961) therefore also loses its guard, so an attacker does not need to target the Nemotron-VL endpoint specifically; any endpoint that decodes attacker-supplied images on an affected worker becomes a memory-amplification primitive. A tiny file (e.g. a few kilobytes of highly compressible raster data) can expand to billions of pixels, and decoding allocates memory proportional to the decompressed bitmap, exhausting the worker before any inference occurs. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high availability impact and no confidentiality or integrity impact) is consistent with the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): unauthenticated, network-reachable, no user interaction, availability-only impact. The limiting factor is configuration-dependent, since instances that never instantiate NanoNemotronVLImageProcessor keep Pillow's default pixel guard intact.
Know when Sglang gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated image submission with no user interaction (AV:N/AC:L/PR:N/UI:N); pure memory-exhaustion DoS yields A:H with no confidentiality or integrity impact and unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic image loader, exhausting worker memory during decoding.
Executive ViewAI
SGLang deployments that load the NanoNemotronVLImageProcessor face a high-severity availability risk: attackers can crash inference workers by submitting small compressed images with enormous pixel dimensions, exhausting memory. This affects only environments using that specific processor, but for those, it can disrupt AI inference services and cause costly downtime. No public exploit identified at time of analysis, but leadership should prioritize identifying affected deployments and applying interim mitigations while awaiting a vendor fix.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network exposure of affected inference endpoints; explicitly set Pillow's Image.MAX_IMAGE_PIXELS to a safe value after loading NanoNemotronVLImageProcessor to re-enable decompression-bomb protection; enforce memory limits and automatic worker restarts; monitor for abnormal memory consumption; consider removing or replacing the NanoNemotronVLImageProcessor until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code b
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe
Remote code execution in SGLang AI inference servers allows unauthenticated attackers to run arbitrary code through the
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the op
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, wh
Unauthenticated remote code execution in SGLang versions through v0.5.20 arises from unsafe pickle deserialization in th
Unauthenticated remote code execution in SGLang 0.5.11 through 0.5.14 occurs when the multimodal generation runtime is l
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsy
Exploit-DB