CVE-2026-109229

CVSS 8.7 (high) · published 2026-10-12

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic image loader, exhausting worker memory during decoding.

Weakness: CWE-409

Source: NVD CVE-2026-109229

References

• https://github.com/sgl-project/sglang
• https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/multimodal/processors/nano_nemotron_vl.py#L82
• https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/utils/common.py#L1952-L1961
• https://github.com/sgl-project/sglang/issues/43707
• https://www.vulncheck.com/advisories/sglang-through-0.5.21-decompression-bomb-dos-via-nanonemotronvlimageprocessor
• https://github.com/sgl-project/sglang/issues/43707

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.