Is CVE-2026-109229 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109229?

CVE-2026-109229 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-109229

Description

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic image loader, exhausting worker memory during decoding.