Is CVE-2026-109225 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109225 being exploited in the wild.

How severe is CVE-2026-109225?

High severity, with a CVSS score of 7.5, published 12 October 2026.

Is there a fix for CVE-2026-109225?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-109225 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-109225?

Check whether you run SGLang at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109225: SGLang unbounded memory allocation in audio transcription endpoint

CVE-2026-109225 · Severity: high · CVSS 7.5 · Published 2026-10-12

SGLang is a high-performance serving framework for large language models and multimodal models. An unauthenticated attacker can crash the service by uploading oversized files to the audio transcription endpoint, causing a denial of service. The vulnerability allows an attacker to exhaust server memory through concurrent large file uploads without any authentication, making the service unavailable to legitimate users.

Technologies: SGLang. Vendors: SGLang.

Quick answers

Is CVE-2026-109225 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109225 being exploited in the wild.
How severe is CVE-2026-109225?: High severity, with a CVSS score of 7.5, published 12 October 2026.
Which products and versions are affected?: SGLang through 0.5.21.
Is there a fix for CVE-2026-109225?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109225 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-109225?: Check whether you run SGLang at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

SGLang through version 0.5.21 contains an unbounded memory allocation vulnerability in the /v1/audio/transcriptions endpoint. The HTTP server reads entire multipart file uploads into memory before validation, allowing an unauthenticated remote attacker to send concurrent large uploads to exhaust memory and crash the tokenizer worker. This is a classic pre-validation memory exhaustion attack against the audio transcription handler.

Affected products

SGLang SGLang through 0.5.21

Timeline

2026-10-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.