CVE-2026-109225

{
  "etk_id": "ETK-2026-1372",
  "cve_id": "CVE-2026-109225",
  "display_id": "CVE-2026-109225",
  "ghsa_id": "GHSA-4fxq-6r94-mchm",
  "euvd_id": "EUVD-2026-97431",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated memory exhaustion in SGLang audio transcription",
  "summary": "SGLang through 0.5.21 is affected by unbounded memory use when handling uploads to the audio transcription endpoint. An unauthenticated remote attacker can exhaust worker memory and cause denial of service by sending oversized concurrent uploads. Exposure requires the affected endpoint to be reachable by the attacker.",
  "mitigation": "Restrict access to the audio transcription endpoint to trusted clients and enforce upload-size and request-concurrency limits in a reverse proxy or gateway. Upgrade to a vendor-fixed release when one is recorded.",
  "vendor": "sgl-project",
  "product": "SGLang",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 0.5.21"
      ],
      "ecosystem": "pypi",
      "fixed_versions": [],
      "package_name": "sglang",
      "purl": "pkg:pypi/sglang"
    }
  ],
  "cwes": [
    770
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0043,
  "epss_percentile": 0.3575,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.002484783333333,
  "t0_at": "2026-10-12T14:04:29.986000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-12T14:04:29.986000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T14:04:29.986000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109225"
    }
  }
}