Executive brief
vLLM is an open-source large language model inference engine that accepts video and image data as input through its OpenAI-compatible API. An attacker can crash vLLM servers by sending a specially crafted request containing an extremely large number of video frames, causing the system to run out of memory. This attack requires no authentication and can be launched over the network, allowing attackers to disable the service and disrupt operations for legitimate users.
Technical details
The vulnerability exists in the VideoMediaIO.load_base64() method, which processes video/jpeg data URLs by splitting base64-encoded data on commas to extract individual JPEG frames. The method does not enforce any limit on the number of frames that can be decoded, allowing an attacker to craft a single API request containing thousands of comma-separated base64-encoded JPEG frames. When the server attempts to decode all frames into memory simultaneously, it exhausts available RAM and crashes. The vulnerability is reachable via the OpenAI-compatible chat completions API endpoint without authentication. vLLM 0.19.0 and later include a frame count limit to mitigate this issue, and patched versions are available from the upstream project.
Affected products
- vLLM Project vLLM 0.8.0 to 0.18.x
Timeline
- 2026-06-11: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-06-11: patched: vLLM 0.19.0 released with frame limit enforcement
References
- https://github.com/vllm-project/vllm/commit/58ee61422169ce17e08248f8efa1e9df434fe395
- https://huntr.com/bounties/7bd92629-b396-4449-8f88-6c0092530eb4
- https://access.redhat.com/security/cve/CVE-2026-5497
- https://bugzilla.redhat.com/show_bug.cgi?id=2487813
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5497.json