CVE-2026-5497: vllm-project vllm-project/vllm Uncontrolled Resource Consumption

Vulnerability summary

CVE-2026-5497 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in vllm-project vllm-project/vllm. EPSS estimates a 0.90% chance of exploitation in the next 30 days, higher than 58.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 11-06-2026
   PublishedVulnerability first disclosed.
2. 22-07-2026
   Last modifiedVulnerability information updated.

Description

vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processing `video/jpeg` data URLs, the method splits the base64 data string on commas to extract individual JPEG frames without enforcing a frame count limit. An attacker can exploit this by crafting a single API request containing thousands of comma-separated base64-encoded JPEG frames in a data URL, causing the server to decode all frames into memory and crash due to excessive memory consumption. This vulnerability is reachable via the OpenAI-compatible chat completions API and does not require authentication.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.