Description

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and concurrent requests exhaust worker memory causing denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-12T14:17:11.923Z",
  "pubdate": "2026-10-12T14:17:11.923Z",
  "executiveSummary": "SGLang versions through 0.5.21 contain an unbounded memory allocation vulnerability within the Qwen-VL integration, specifically in the preprocess_video function located in qwen_vl.py.\nThe vulnerability allows for a denial-of-service (DoS) attack by leveraging improper input validation during video frame decoding.\nAn unauthenticated remote attacker can submit maliciously crafted high-resolution video inputs to the /v1/chat/completions endpoint, triggering excessive memory consumption.\nBy issuing concurrent requests containing these high-resolution payloads, an attacker can exhaust the system's available memory, leading to worker process termination or total service failure.\nThe vulnerability poses a high risk to availability, particularly in production environments exposed to the public internet where rate limiting or input size constraints are not strictly enforced.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the preprocess_video function within the qwen_vl.py component of SGLang. The processing pipeline performs full-resolution decoding of video frames prior to the application of max_pixels limits designed to constrain resource usage.\nIn a standard request flow, a client transmits a video payload via the /v1/chat/completions API endpoint. Upon receipt, the application initiates the frame extraction and preprocessing stage. The vulnerable function fails to validate or downsample the video frames before committing them to memory for decoding. Consequently, a high-resolution or high-bitrate video forces the application to allocate memory proportional to the source resolution rather than the intended target resolution governed by the max_pixels parameter.\nThe attack flow follows a predictable pattern: an attacker crafts a request containing an extremely high-resolution video file. When this request reaches the SGLang worker, the process initiates an intensive memory allocation event to store the raw decoded frames. Because this occurs before the resizing logic is executed, the process memory footprint grows significantly. An attacker can amplify this effect by flooding the endpoint with concurrent requests. Given that each process is subject to finite memory constraints, the cumulative allocation leads to immediate memory exhaustion.\nThis behavior results in a classic heap-based resource exhaustion. As the memory usage exceeds the host's physical capacity or container limits (OOM), the operating system or container orchestrator terminates the SGLang worker process to maintain system stability. The absence of strict input sanitization or pre-decoding constraints renders the system susceptible to remote DoS attacks. No authentication or elevated privileges are required to initiate this exploit, as the endpoint is typically exposed for inference tasks, making the attack surface publicly accessible in many deployment configurations."
}