CVE-2026-109229Published
SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-109229 · Microsoft / collected KEV context
cve-program · CVE-2026-109229
- https://github.com/sgl-project/sglang/issues/43707
- https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/multimodal/processors/nano_nemotron_vl.py#L82
- https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/utils/common.py#L1952-L1961
- https://github.com/sgl-project/sglang
- https://www.vulncheck.com/advisories/sglang-through-0.5.21-decompression-bomb-dos-via-nanonemotronvlimageprocessor
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.