CVE-2026-109229: SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAXIMAGEPIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic image loader, exhausting worker memory during decoding.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
SGLang deployments through 0.5.21 that accept remotely supplied images for processing are exposed. An attacker can target the generic image loader with a small compressed image that expands to very large dimensions when decoded.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network access, low attack complexity, no privileges required, and no user interaction.
What is the practical impact of a successful attack?
Decoding a decompression-bomb image can exhaust worker memory and cause denial of service. The provided impact data indicates availability impact only, with no stated confidentiality or integrity impact.
Why can this affect image handling beyond the NanoNemotronVL processor?
The processor sets Pillow's Image.MAX_IMAGE_PIXELS value to None process-wide. This disables Pillow decompression-bomb protection for generic image loading in that process.