Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processing `video/jpeg` data URLs, the method splits the base64 data string on commas to extract individual JPEG frames without enforcing a frame count limit. An attacker can exploit this by crafting a single API request containing thousands of comma-separated base64-encoded JPEG frames in a data URL, causing the server to decode all frames into memory and crash due to excessive memory consumption. This vulnerability is reachable via the OpenAI-compatible chat completions API and does not require authentication.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-11 | 2 | Disclosure2 |
| 2026-06-12 | 1 | General1 |
Some increased actor activities are shown targeting vLLM (CVE-2026-5497) https://vuldb.com/vuln/370359/cti
Post summary
Threat intelligence reports increased actor interest in CVE‑2026‑5497 (vLLM), but no evidence of active exploitation, PoC, or patch is provided.
🚨*CVE* CVE-2026-5497 vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_… https://www.cve.org/CVERecord?id=CVE-2026-5497 ----- Traducción: CVE-2026-5497 vLL… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-5497, an OOM denial‑of‑service vulnerability in vLLM 0.8.0+, but provides no PoC, exploit, or patch details.
CVE-2026-5497 vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_… https://www.cve.org/CVERecord?id=CVE-2026-5497
Post summary
The text discloses a CVE‑2026‑5497 vulnerability in vLLM 0.8.0+, detailing an out‑of‑memory denial‑of‑service attack caused by unbounded frame count processing, without providing a PoC, exploit, patch, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vllm | vllm | - | - | - |