Unbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllm
Priority HIGH 72CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 3 fixed, 3 without a fix
Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processing `video/jpeg` data URLs, the method splits the base64 data string on commas to extract individual JPEG frames without enforcing a frame count limit. An attacker can exploit this by crafting a single API request containing thousands of comma-separated base64-encoded JPEG frames in a data URL, causing the server to decode all frames into memory and crash due to excessive memory consumption. This vulnerability is reachable via the OpenAI-compatible chat completions API and does not require authentication.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00537 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial vllm-project/vllm (vllm-project): 0.19.0vllm (PyPI): 0.19.0Red Hat: 11 advisoriesRed Hat: 3 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vllm-project | vllm-project/vllm | before 0.19.0 | 0.19.0 | Patch available | CNA |
| — | vllm (PyPI) | 0.8.0 to before 0.19.0 | 0.19.0 | Patch available | GHSA-wcwg-c5fc-9vrc |
- vllm-project/vllm Vendorvllm-project Affected before 0.19.0 Fixed in 0.19.0 Patch available CNA
- vllm (PyPI) Vendor— Affected 0.8.0 to before 0.19.0 Fixed in 0.19.0 Patch available GHSA-wcwg-c5fc-9vrc
Remediation
- Fix · CNA vllm-project/vllm (vllm-project) Fixed in 0.19.0
- Fix · GHSA-wcwg-c5fc-9vrc vllm (PyPI) Fixed in 0.19.0 Advisory →
Red Hat 11 advisories
- RHSA-2026:87410 Released 2026-10-21 · Red Hat rating CriticalRHOAI 2.25.12 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
- RHSA-2026:76150 Released 2026-10-05 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.4.5 security update
- Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
- RHSA-2026:76149 Released 2026-10-05 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.4.5 security update
- Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
Show 8 more Red Hat advisories
- RHSA-2026:70995 Released 2026-09-23 · Red Hat rating ImportantRed Hat AI Inference 3.4.5 (rocm)
- Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-rocm-rhel9
- RHSA-2026:70979 Released 2026-09-23 · Red Hat rating ImportantRed Hat AI Inference 3.4.5 (cuda)
- Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cuda-rhel9
- RHSA-2026:70969 Released 2026-09-23 · Red Hat rating ImportantRed Hat AI Inference 3.4.5 (spyre)
- Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-spyre-rhel9
- RHSA-2026:70965 Released 2026-09-23 · Red Hat rating ImportantRed Hat AI Inference 3.4.5 (cpu)
- Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cpu-rhel9
- RHSA-2026:69469 Released 2026-09-21 · Red Hat rating ImportantRed Hat AI Inference 3.4.5 (rocm)
- Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-rocm-rhel9
- RHSA-2026:69467 Released 2026-09-21 · Red Hat rating ImportantRed Hat AI Inference 3.4.5 (cuda)
- Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cuda-rhel9
- RHSA-2026:69466 Released 2026-09-21 · Red Hat rating ImportantRed Hat AI Inference 3.4.5 (cpu)
- Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cpu-rhel9
- RHSA-2026:69464 Released 2026-09-21 · Red Hat rating ImportantRed Hat AI Inference 3.4.5 (spyre)
- Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-spyre-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AI Inference Server | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat AI Inference Server 3.4 | Fixed | RHSA-2026:69464, RHSA-2026:69466, RHSA-2026:69467, RHSA-2026:69469, RHSA-2026:70965, RHSA-2026:70969, RHSA-2026:70979, RHSA-2026:70995 |
| Red Hat Enterprise Linux AI 3.4 | Fixed | RHSA-2026:76149, RHSA-2026:76150 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:87410 |
Not affected: 2 products
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
Timeline
- 2026-10-02 Threatist record created from CVE-2026-5497
- 2026-10-03 Alias added: GHSA-wcwg-c5fc-9vrc
- 2026-10-06 Fix available: RHSA-2026:76149 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:76150 · Red Hat
- 2026-10-06 Fix available: Red Hat Enterprise Linux AI 3.4 · Red Hat
- 2026-10-07 Affected versions changed · Red Hat
- 2026-10-12 Affected versions changed · Red Hat
- 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
- 2026-10-23 Fix available: Red Hat OpenShift AI 2.25 · Red Hat
- 2026-10-25 EPSS moved to the below the 50th percentile
References
Other 7
- https://access.redhat.com/errata/RHSA-2026:33524
- https://access.redhat.com/errata/RHSA-2026:33531
- https://access.redhat.com/security/cve/CVE-2026-5497
- https://bugzilla.redhat.com/show_bug.cgi?id=2487813
- https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-2302.yaml
- https://github.com/vllm-project/vllm
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5497.json
More vllm-project vulnerabilities
- TI-2024-10229 Remote Code Execution in vllm-project/vllm CVSS 3.0CRITICAL 9.8
- TI-2024-08404 Remote Code Execution in vllm-project/vllm CVSS 3.1CRITICAL 9.8
- TI-2026-36017 vLLM: OpenAI auth bypass CVSS 3.1CRITICAL 9.1
- TI-2026-63056 vLLM before 0.28.0 Denial of Service via negative token ID CVSS 4.0HIGH 8.7
- TI-2026-04308 Hardcoded trust_remote_code=True in vllm-project/vllm Bypasses User Security Control CVSS 3.0HIGH 8.8
- TI-2026-39137 vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection CVSS 3.1HIGH 7.5
Sources
- CVE-2026-5497 · CVE Program
- CVE-2026-5497 · NVD
- FIRST EPSS
- GHSA-wcwg-c5fc-9vrc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-5497 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences