vLLM CVE-2026-5497

Exploitation requires that the target run vLLM 0.8.0 or later with the OpenAI-compatible chat completions API reachable by the attacker and serving a multimodal model whose request handling routes video/jpeg data URLs through VideoMediaIO.load_base64(); no authentication, user interaction, or non-default configuration is required beyond enabling video input on the served model. Limiting factors: deployments that do not expose the chat completions endpoint to untrusted networks, that serve text-only models without the video media path, that have already upgraded past commit 58ee614, or that sit behind a proxy enforcing strict request body size limits will not be exploitable in practice.

The provided CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H is consistent with the description - the vulnerable endpoint is the unauthenticated OpenAI-compatible chat completions API, exploitation is a single crafted request, and impact is limited to availability (server OOM crash). This is a real operational risk for any vLLM 0.8.0+ deployment exposed to untrusted clients (public inference endpoints, multi-tenant model serving), because a single small request can take down a GPU-backed worker that is expensive to restart and warm up. There is no KEV listing and no EPSS score in the input, and no public exploit has been identified at time of analysis, so widespread mass exploitation is not yet evidenced; however, the fix is public on GitHub and the trigger is trivial to reconstruct from the test case in the patch, so exploit code is expected to appear quickly. Confidentiality and integrity are unaffected, so this should be triaged as an availability-only issue rather than a full compromise risk.

An attacker who can reach a vLLM server's /v1/chat/completions endpoint sends a single unauthenticated POST whose message content includes an image_url with a data:video/jpeg;base64,<frame1>,<frame2>,...,<frameN> payload containing tens of thousands of tiny base64-encoded JPEGs separated by commas. VideoMediaIO.load_base64() splits on every comma and decodes each frame into a NumPy array via PIL, ballooning resident memory until the worker is killed by the OOM killer, taking the inference service offline. No public PoC is identified at time of analysis, but the patch's added test (_make_jpeg_b64_frames + comma-join) is essentially a working trigger.