CVE-2026-5497: vLLM vulnerable to OOM Denial of Service

# CVE-2026-5497: vLLM vulnerable to OOM Denial of Service

https://gcdradar.vercel.app/incidents/cve-2026-5497-vllm-vulnerable-to-oom-denial-of-service · AIR-2026-0727 · closed 2026-06-11

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-06-11
- AI role: Attack on AI
- Products: vLLM
- CVE ids: CVE-2026-5497
- CVSS: 7.5

## Summary

An out-of-memory denial of service vulnerability exists in vLLM due to unbounded frame count processing in base64 video loading. The flaw allows unauthenticated API requests to crash inference servers through excessive memory consumption.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-06-11: CVE-2026-5497: vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame… (https://nvd.nist.gov/vuln/detail/CVE-2026-5497)
- 2026-06-11: CVE-2026-5497: vLLM is vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the… (https://github.com/advisories/GHSA-wcwg-c5fc-9vrc)

## Sources

- 2026-06-11 GitHub Advisory Database: CVE-2026-5497: vLLM is vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the… https://github.com/advisories/GHSA-wcwg-c5fc-9vrc
- 2026-06-11 NVD: CVE-2026-5497: vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame… https://nvd.nist.gov/vuln/detail/CVE-2026-5497

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.