Description

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before validation, to crash the HTTP/tokenizer worker and deny service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-12T14:17:11.580Z",
  "pubdate": "2026-10-12T14:17:11.580Z",
  "executiveSummary": "SGLang through version 0.5.21 is susceptible to an unbounded memory allocation vulnerability within its HTTP/tokenizer worker components. This security flaw stems from the improper handling of multipart file uploads at the /v1/audio/transcriptions endpoint, where incoming data streams are ingested into system memory in their entirety prior to validation or sanitization. An unauthenticated, remote attacker can leverage this behavior by initiating multiple concurrent, oversized multipart upload requests, resulting in rapid consumption of available system RAM. This process triggers an out-of-memory (OOM) condition, forcing the service to crash and effectively causing a Denial of Service (DoS) for the affected worker. The vulnerability is critical for environments where SGLang is exposed to external network traffic, as it requires no prior authentication or administrative privileges to execute. The primary risk implication is the sustained unavailability of the transcription service, which may disrupt downstream machine learning pipelines and dependent applications.",
  "technicalDetails": "The vulnerability resides in the request processing logic of the SGLang HTTP/tokenizer worker, specifically within the handler responsible for /v1/audio/transcriptions. The root cause is an architecture that lacks a streaming buffer limit or pre-validation mechanism for incoming multipart/form-data payloads. When a user submits an audio file, the application attempts to read the entire body of the request into memory before verifying file size, type, or integrity constraints.\nThe attack flow commences when an attacker transmits a specially crafted, maliciously large multipart upload request to the /v1/audio/transcriptions endpoint. By initiating multiple concurrent requests of this nature, the attacker forces the worker process to allocate memory blocks proportional to the aggregate size of the incoming payloads. Because the application does not impose a threshold on the buffer size during the ingestion phase, memory utilization scales linearly with the number and size of concurrent requests. Once the allocated memory exceeds the available physical memory or the configured limits of the container/process environment, the system triggers an out-of-memory exception or is terminated by the OS kernel, leading to a service crash.\nThis vulnerability is strictly an unauthenticated remote DoS vector. Because the HTTP stack does not validate the content-length or sanitize the request body prior to loading it into memory, no legitimate credentials are required. The network exposure is broad, as any entity with reachability to the SGLang API endpoint can execute the exploit. Post-exploitation, the impact is confined to the immediate termination of the service; however, in orchestrated environments (e.g., Kubernetes), continuous exploitation can lead to a 'crash loop' state, preventing the service from recovering and maintaining a permanent Denial of Service. The lack of an intermediate stream-processing layer means that there is no mechanism to drop malicious requests once the ingestion has begun, making the worker highly vulnerable to even low-bandwidth, high-payload-size attacks."
}