Out-of-Memory Denial of Service in vLLM Product by vLLM Project

CVE-2026-5497

What is CVE-2026-5497?

The vLLM product is susceptible to an Out-of-Memory Denial of Service due to a flaw in the VideoMediaIO.load_base64() method. This vulnerability allows an attacker to craft an API request that contains a vast number of base64-encoded JPEG frames without any limit on frame count. When the server processes these requests, it can lead to excessive memory usage, causing a crash. The vulnerability can be exploited via the OpenAI-compatible chat completions API without the need for authentication, making it particularly concerning.

References