CVE-2026-109225: SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before validation, to crash the HTTP/tokenizer worker and deny service.