{
 "id": "AIR-2026-0727",
 "slug": "cve-2026-5497-vllm-vulnerable-to-oom-denial-of-service",
 "title": "CVE-2026-5497: vLLM vulnerable to OOM Denial of Service",
 "summary": "An out-of-memory denial of service vulnerability exists in vLLM due to unbounded frame count processing in base64 video loading. The flaw allows unauthenticated API requests to crash inference servers through excessive memory consumption.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "vLLM"
 ],
 "incident_date": "2026-06-11",
 "incident_date_precision": "day",
 "first_reported": "2026-06-11",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-wcwg-c5fc-9vrc",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-5497: vLLM is vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the…",
   "published_at": "2026-06-11"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5497",
   "publisher": "NVD",
   "title": "CVE-2026-5497: vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame…",
   "published_at": "2026-06-11"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2026-5497",
  "dos",
  "vllm"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}