Description

SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio_url or audio_data inputs that expand into massive PCM buffers, exhausting worker memory and CPU for denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-12T14:17:11.747Z",
  "pubdate": "2026-10-12T14:17:11.747Z",
  "executiveSummary": "SGLang versions up to and including 0.5.21 are susceptible to a critical decompression amplification vulnerability within the load_audio function. This flaw allows remote, unauthenticated attackers to trigger a resource exhaustion condition, specifically targeting memory and CPU availability. By submitting maliciously crafted, highly compressed FLAC-encoded audio files—often small files representing silence—the system performs an unbounded decompression process into PCM (Pulse Code Modulation) format. Because the input processing logic lacks essential duration and sample count constraints, the expansion ratio can be extreme, leading to massive memory allocation requests. The primary risk is a Denial of Service (DoS) condition, where the worker process consumes system memory until it crashes or triggers OOM (Out of Memory) kills. This vulnerability enables remote attackers to destabilize the service, potentially causing a complete service outage by targeting specific endpoints exposed through audio_url or audio_data input vectors.",
  "technicalDetails": "The vulnerability resides in the internal audio processing routine, specifically the load_audio function, which handles input streams for downstream model processing. The root cause is a failure to implement validation constraints on the decompressed output size of audio files. The application utilizes a codec library to handle FLAC data, which provides high compression ratios for periodic signals such as silence or low-frequency content. When the load_audio function receives a payload through the audio_url or audio_data interfaces, it initiates an automatic decompression process without first verifying the metadata—specifically the total sample count or expected playback duration.\nThe exploitation flow begins with an attacker crafting a small, high-density FLAC file. This file contains metadata suggesting a standard compression profile, but its content is structured to expand into a buffer significantly larger than the original file size during the decoding phase. When the SGLang worker receives this payload, the underlying library allocates memory in the process heap to accommodate the full, uncompressed PCM waveform. Because the application logic proceeds to allocate this memory without checking the final size against predefined security thresholds, a single request can force the worker to request gigabytes of RAM.\nThe attack is highly effective because it requires minimal bandwidth and low computational effort on the part of the attacker, while imposing a disproportionate cost on the server. The lack of bounds checking on the resulting audio buffer causes the process memory footprint to spike instantly. If multiple such requests are issued in parallel, the total system memory is rapidly exhausted. This results in the operating system invoking the OOM killer on the SGLang worker process, effectively terminating the service. The vulnerability is exploitable remotely by any user capable of interacting with the SGLang API interfaces that accept audio inputs. As the function does not validate the integrity of the stream against a maximum allowed decoded duration, the system is defenseless against this amplification vector. There is no requirement for high-level privileges, as the ingestion and decoding of audio data are typically standard operations for the service."
}