Description

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic image loader, exhausting worker memory during decoding.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-12T14:17:12.257Z",
  "pubdate": "2026-10-12T14:17:12.257Z",
  "executiveSummary": "SGLang versions through 0.5.21 contain a critical Denial of Service (DoS) vulnerability arising from the improper configuration of the Pillow library's security limits. Specifically, the NanoNemotronVLImageProcessor component programmatically disables decompression bomb protection by setting Image.MAX_IMAGE_PIXELS to None. This globally modifies the runtime environment, removing the safeguard that prevents the processing of excessively large image files. A remote attacker can exploit this by submitting a specially crafted, highly compressed image—often referred to as a 'decompression bomb' or 'pixel flood'—designed to consume vast amounts of system memory upon expansion. The vulnerability is highly impactful as it leads to worker process crashes, potential memory exhaustion (OOM), and total service unavailability for the affected node. Because this setting is process-wide, the vulnerability extends beyond the immediate image processing task to any other functionality sharing the same process memory space. Exploitation requires no authentication and is feasible through standard network-accessible endpoints that accept user-provided image data for inference or processing tasks.",
  "technicalDetails": "The vulnerability originates in the NanoNemotronVLImageProcessor component of SGLang. The underlying issue is the explicit invocation of Image.MAX_IMAGE_PIXELS = None within the processor's initialization or configuration phase. In the Python Imaging Library (Pillow), MAX_IMAGE_PIXELS serves as a critical security control designed to mitigate decompression bombs—malicious files engineered to consume excessive memory relative to their small file size by declaring large dimensions (e.g., millions of pixels in each direction) that cause the decoder to allocate massive contiguous memory blocks during decompression.\nBy setting this value to None, the application effectively disables all per-image size validation across the entire runtime process. This is a hazardous design choice because it exposes the application to resource exhaustion attacks even when the developer may have only intended to permit large images for a specific use case. The attack flow begins when an attacker identifies an endpoint in the SGLang infrastructure that utilizes NanoNemotronVLImageProcessor for image ingestion or preprocessing.\nThe attacker constructs a malicious payload, typically a file with a small byte count that encodes header metadata specifying extreme width and height dimensions. Upon submitting this payload, the SGLang worker process invokes the Pillow library to decode the image. Because the protection mechanism has been globally disabled, the decoder proceeds to attempt memory allocation based on the dimensions extracted from the file headers. This allocation request is frequently large enough to trigger an Out-of-Memory (OOM) condition, leading to the SIGKILL termination of the worker process by the operating system kernel or causing significant latency as the system enters swap space.\nThe impact is magnified by the fact that many SGLang deployments use worker pools; repeated exploitation can lead to a cascading failure where all available inference workers are terminated, resulting in a total denial of service. The vulnerability is present in all versions up to and including 0.5.21. Since the modification occurs at the process level, there are no specific privilege requirements for the attacker, and the exploitation is entirely remote and network-based, targeting the application's ingestion layer directly."
}