{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/sglang--0.5.21/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sglang:sglang:*:*:*:*:*:*:*:*"],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SGLang (\u003c= 0.5.21)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","sglang"],"_cs_type":"advisory","_cs_vendors":["SGLang"],"content_html":"\u003cp\u003eSGLang through version 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust system memory. The vulnerability exists within the /v1/audio/transcriptions endpoint, which fails to properly validate the size of incoming multipart file uploads. Because the application reads the entirety of these files into memory prior to performing size validation or processing, an attacker can leverage concurrent, oversized upload requests to trigger a service crash. This results in the denial of service for the HTTP and tokenizer worker components, potentially impacting the availability of the model serving infrastructure. Defenders should prioritize updating to a patched version or implementing request size limits at the load balancer or reverse proxy layer to mitigate potential exploitation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a high risk to availability, specifically for infrastructure relying on the affected SGLang audio transcription endpoint. Successful exploitation results in a service crash of the worker processes, denying legitimate users access to transcription services. This impacts any sector deploying SGLang for speech processing, particularly those with public-facing API interfaces.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImplement request body size limits at the edge (e.g., Nginx client_max_body_size) to block excessively large multipart uploads before they reach the SGLang application.\u003c/li\u003e\n\u003cli\u003eMonitor webserver logs for high-frequency or large POST requests targeting the /v1/audio/transcriptions endpoint.\u003c/li\u003e\n\u003cli\u003ePatch SGLang to the version addressing this memory allocation flaw as soon as vendor guidance is released.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T15:43:39Z","date_published":"2026-10-12T15:43:13Z","id":"https://feed.craftedsignal.io/briefs/2026-10-sglang-dos/","summary":"SGLang versions up to 0.5.21 are vulnerable to a denial-of-service condition via an unbounded memory allocation issue in the /v1/audio/transcriptions endpoint.","title":"Unbounded Memory Allocation in SGLang","url":"https://feed.craftedsignal.io/briefs/2026-10-sglang-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - SGLang (\u003c= 0.5.21)","version":"https://jsonfeed.org/version/1.1"}