---
id: "CVE-2026-116095"
kind: "vulnerability"
aliases: ["CVE-2026-116095"]
title: "smg: JPEG decoder allocates unbounded memory, letting remote requests exhaust server memory"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "llm-gateway", "multimodal", "rust", "self-hosted", "smg"]
not_affected_if: ["no-image-input", "version-1.11.0-or-later"]
published_at: "2026-10-25T23:17:41+00:00"
first_seen_at: "2026-10-25T23:36:15+00:00"
updated_at: "2026-10-25T23:36:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116095", "first_seen_at": "2026-10-25T23:36:15+00:00"}]
---

# smg: JPEG decoder allocates unbounded memory, letting remote requests exhaust server memory

The smg project's llm-multimodal component decodes JPEG images in jpeg_turbo::decode_jpeg_rgb without limiting memory allocation, so a crafted image can make the process allocate excessive memory. A remote attacker can use the publicly available exploit to degrade or crash the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed smg version (for example `smg --version` or the lockfile entry) and see whether it is one of 1.7.0, 1.8.0, 1.9.0, 1.10.0 or 1.10.1.
- Confirm whether the deployment accepts image input for the llm-multimodal path (multimodal requests reaching decode_jpeg_rgb).

## Fix

- Upgrade smg to `1.11.0`, which includes patch commit 8f51b57e219a914089e345b704c3c8de37a3bb8e.
- Until upgraded, limit request body size and image dimensions at the gateway in front of smg.

## Timeline

- 2026-10-25T23:36:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116095

## From the sources

A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 1.11.0 is able to address this issue. The identifier of the patch is 8f51b57e219a914089e345b704c3c8de37a3bb8e. It is advisable to upgrade the affected component.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_