CVE-2026-5497: Unbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllm

Synopsis

An out-of-memory denial-of-service vulnerability affects vLLM (vllm-project/vllm) versions 0.8.0 through 0.18.x. The flaw is in the VideoMediaIO.load_base64() method, which splits comma-separated base64 JPEG frames from a video/jpeg data URL without enforcing any upper limit on frame count. An attacker can send a single crafted HTTP request to the OpenAI-compatible chat completions API containing thousands of JPEG frames, causing the server to exhaust available memory and crash. A patched-image rebuild at version 0.19.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network via the OpenAI-compatible HTTP API, so an attacker must be able to reach the service across the network.

• AuthenticationNot required

  The chat completions API endpoint accepts requests without any authentication credential, so no account or token is needed.

• Victim interactionNot required

  The attack is fully server-side; no user action or social engineering is needed beyond submitting the crafted API request.

• Attack complexityDetail

  Exploitation is reliable and condition-free: a single well-formed HTTP request carrying a comma-padded base64 data URL is sufficient to trigger the memory exhaustion.

Blast Radius

• Crashes the vLLM inference server process due to total memory exhaustion, taking down all inference capacity on that host.
• Denies service to every client depending on the affected vLLM instance for the duration of the outage or until the process is restarted.
• No confidential data is read and no stored data is modified; impact is limited to availability.