Description

SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_tokens_per_frame and max_image_tokens in the video_url object. Attackers can set these values arbitrarily high so glm4v.py decodes every frame of high-resolution video at full size, exhausting worker memory and denying service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-12T14:17:12.087Z",
  "pubdate": "2026-10-12T14:17:12.087Z",
  "executiveSummary": "SGLang versions through 0.5.21 are susceptible to a resource budget bypass vulnerability involving the improper handling of video processing parameters within the GLM-V model pipeline.\nThe vulnerability is classified as a Denial of Service (DoS) flaw, where the lack of server-side validation on user-supplied input allows for the exhaustion of system memory.\nBy manipulating specific parameters in the video_url object, remote, unauthenticated attackers can force the application to perform excessive high-resolution frame decoding.\nThis behavior results in a complete exhaustion of worker node memory resources, rendering the SGLang service unavailable.\nThe risk is significant due to the simplicity of the exploitation vector, which requires no elevated privileges or complex authentication, potentially allowing threat actors to disrupt LLM serving infrastructure with minimal effort.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input sanitization and constraint enforcement within the GLM-V video processing logic, specifically located in glm4v.py.\nSGLang provides an interface for users to influence video processing parameters via the video_url object. These parameters include fps (frames per second), max_frames, max_tokens_per_frame, and max_image_tokens. The implementation fails to enforce reasonable upper bounds or enforce internal configuration limits on these variables during the ingestion phase.\nThe attack flow initiates when a remote attacker submits a specially crafted request containing malicious values for the aforementioned parameters. By setting these to arbitrarily high values, the attacker instructs the backend to bypass intended resource budget constraints. When glm4v.py processes this input, it initiates a decoding operation that attempts to process every frame of a provided high-resolution video at full resolution.\nBecause the system honors these inflated values, the worker process allocates memory proportional to the request parameters rather than the actual available server capacity. This leads to an out-of-memory (OOM) condition on the worker node. Since these processes are typically essential for inference, the total depletion of available RAM causes the worker to crash or hang, effectively resulting in a denial of service.\nThe vulnerability is present in all versions up to 0.5.21. No specific authentication is required, as the endpoint is typically exposed to receive inference requests. The lack of middleware or validation logic between the input handler and the video processing engine allows the payload to be processed directly. This vulnerability highlights a failure in trust boundary maintenance, where client-side input is treated as authoritative for resource allocation decisions within the worker runtime."
}