CVE-2026-5497

Name of the Vulnerable Software and Affected Versions vLLM versions 0.8.0 and later

Description An Out-of-Memory (OOM) Denial of Service (DoS) issue exists due to unbounded frame count processing in the VideoMediaIO.load base64() function. When processing video/jpeg data URLs, the system splits the base64 data string on commas to extract JPEG frames without enforcing a limit on the number of frames. An attacker can send a single API request containing thousands of comma-separated base64-encoded JPEG frames, causing the server to decode all frames into memory and crash. This is reachable via the OpenAI-compatible chat completions API and does not require authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.