CVE-2026-109228
SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters
sgl-project sglang
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.49%Chance of exploitation activity in the next 30 days, higher than 41% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_tokens_per_frame and max_image_tokens in the video_url object. Attackers can set these values arbitrarily high so glm4v.py decodes every frame of high-resolution video at full size, exhausting worker memory and denying service.
Text from CVE List
Affected versions 1
- sglangaffected: all versions through 0.5.21CVE List
References 7
- vulncheck.com/advisories/sglang-through-0.5.21-resource-budget-bypass-via-glm-v-video-parametersAdvisoryvia CVE List
- github.com/sgl-project/sglang/issues/43705Referencevia CVE List
- github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/entrypoints/openai/protocol.py#L592-L594Referencevia CVE List
- github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/parser/conversation.py#L691Referencevia CVE List
- github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/multimodal/processors/glm4v.py#L160-L167Referencevia CVE List
- github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/multimodal/processors/glm4v.py#L400Referencevia CVE List
- github.com/sgl-project/sglangReferencevia CVE List