https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-13T13:02:31.782197+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-109229 CVE-2026-109229 — SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor 2026-10-13T13:02:31.783453+00:00

Affected: sgl-project sglang

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic image loader, exhausting worker memory during decoding.