Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
vllm-project vllm-project/vllm — Unbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllm
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U N N H 7.5 .0054 43.3 —
AFFECTED
Product Versions Fixed
vllm-project/vllm unspecified – —
TIMELINE
Apr 3 Reserved by @huntr_ai
Jun 11 EXPLOIT PUBLISHED — CVE-2026-5497 (vllm-project/vllm). Public exploit reference added.
Jun 11 Published (CNA: @huntr_ai)
Jul 22 EXPLOIT PUBLISHED — CVE-2026-5497 (vllm-project/vllm). Public exploit reference added.
Description
vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processing `video/jpeg` data URLs, the method splits the base64 data string on commas to extract individual JPEG frames without enforcing a frame count limit. An attacker can exploit this by crafting a single API request containing thousands of comma-separated base64-encoded JPEG frames in a data URL, causing the server to decode all frames into memory and crash due to excessive memory consumption. This vulnerability is reachable via the OpenAI-compatible chat completions API and does not require authentication.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| April 3, 2026 | Reserved | Reserved by @huntr_ai |
| June 11, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-5497 (vllm-project/vllm). Public exploit reference added. |
| June 11, 2026 | Published | Published (CNA: @huntr_ai) |
| July 22, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-5497 (vllm-project/vllm). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| vllm-project | vllm-project/vllm | — | unspecified | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-5497 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.