SGLang through version 0.5.21 contains a denial of service vulnerability that disables Pillow’s decompression bomb protection by setting Image.MAX_IMAGE_PIXELS to None. This change removes a critical safety check, allowing remote users to submit small, highly compressed images that, when processed, cause the generic image loader to allocate vast amounts of memory. The attacker can thus drive the application into resource exhaustion, resulting in service disruption.

The affected vendor is sgl-project and the product is SGLang. All releases through SGLang 0.5.21 are impacted; newer versions are presumed to contain the fix. Organizations using any of these versions should verify their installation version to confirm whether the vulnerability is present.

The CVSS score for this issue is 8.7, indicating a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Remote attackers can exploit the flaw by submitting crafted images that are processed by the NanoNemotronVLImageProcessor component. The attack requires only the ability to send a request containing the image; if the image loader is exposed to an untrusted input, the attacker can trigger memory exhaustion and potentially cause the process or entire application to crash. The likelihood of exploitation is uncertain without EPSS data, but the high severity and lack of mitigation in the affected versions make it a significant risk for exposed deployments.