CVE-2026-5497

vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processing `video/jpeg` data URLs, the method splits the base64 data string on commas to extract individual JPEG frames without enforcing a frame count limit. An attacker can exploit this by crafting a single API request containing thousands of comma-separated base64-encoded JPEG frames in a data URL, causing the server to decode all frames into memory and crash due to excessive memory consumption. This vulnerability is reachable via the OpenAI-compatible chat completions API and does not require authentication.

• CWE-400
• CWE-770

• https://github.com/vllm-project/vllm/commit/58ee61422169ce17e08248f8efa1e9df434fe395Patch
• https://huntr.com/bounties/7bd92629-b396-4449-8f88-6c0092530eb4Exploit, Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2026-5497
• https://bugzilla.redhat.com/show_bug.cgi?id=2487813
• https://huntr.com/bounties/7bd92629-b396-4449-8f88-6c0092530eb4Exploit, Third Party Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5497.json

Published

Jun 11, 2026

Last Modified

Jul 22, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54919cpp-httplib is a C++11 single-file header-only cross platfor…7.4
• CVE-2026-5492DriveLock Directory Traversal Information Disclosure Vulnera…6.5
• CVE-2026-5493Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bou…7.8
• CVE-2026-5494Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bou…7.8
• CVE-2026-5495Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bou…7.8
• CVE-2026-5496Labcenter Electronics Proteus PDSPRJ File Parsing Type Confu…7.8
• CVE-2026-54981Inclusion of functionality from untrusted control sphere in …7.8
• CVE-2026-54982Integer underflow (wrap or wraparound) in Reliable Multicast…8.8
• CVE-2026-54983Stack-based buffer overflow in Active Directory Federation S…7.5
• CVE-2026-54984Heap-based buffer overflow in Windows Imaging Component allo…7.8
• CVE-2026-54986Heap-based buffer overflow in Windows Win32K allows an autho…7.8
• CVE-2026-54987Heap-based buffer overflow in Windows Overlay Filter allows …7.8