SGLang versions up to 0.5.21 contain a decompression amplification flaw in the load_audio routine that expands tiny, highly compressed FLAC pods of silence into enormous PCM buffers. By submitting these files, a remote attacker can cause the worker process to consume large amounts of memory and CPU, disrupting service availability. The vulnerability is a classic resource exhaustion attack with no authentication requirements.

The flaw affects all releases of SGLang up to and including 0.5.21. Any installation that exposes the load_audio function via audio_url or audio_data inputs is vulnerable.

The CVSS score of 8.7 categorizes this issue as high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the lack of limits on input size and sample count gives attackers a straightforward remote attack path that can lead to denial of service. Exploitation requires only the ability to submit arbitrary audio data to the vulnerable endpoint.