{"id":"CVE-2026-109228","revision":"50c0d8ff08fd47c1b85c791b0b8f51b9","records":[{"revision":"50c0d8ff08fd47c1b85c791b0b8f51b9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-109228","aliases":[],"title":"SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters","description":"SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_tokens_per_frame and max_image_tokens in the video_url object. Attackers can set these values arbitrarily high so glm4v.py decodes every frame of high-resolution video at full size, exhausting worker memory and denying service.","state":0,"publishedAt":"2026-10-12T14:04:32.029+00:00","modifiedAt":"2026-10-14T17:52:09.025+00:00","affected":[{"ecosystem":"https://pypi.org/project/sglang","name":"sglang","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"sgl-project\",\n                    \"product\": \"sglang\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:pypi/sglang\",\n                    \"repo\": \"https://github.com/sgl-project/sglang\",\n                    \"collectionURL\": \"https://pypi.org/project/sglang\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThanOrEqual\": \"0.5.21\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/sgl-project/sglang/issues/43705","https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/entrypoints/openai/protocol.py#L592-L594","https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/parser/conversation.py#L691","https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/multimodal/processors/glm4v.py#L160-L167","https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/multimodal/processors/glm4v.py#L400","https://github.com/sgl-project/sglang","https://www.vulncheck.com/advisories/sglang-through-0.5.21-resource-budget-bypass-via-glm-v-video-parameters"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109228","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-109228","identifiers":["CVE-2026-109228"]},"retained":false,"historicalAffected":[]}],"coverage":[]}