{"action":"Upgrade vllm to 0.19.0 or later.","affected":[{"fixed":"0.19.0","introduced":"0.8.0"}],"component":"vllm","cve_ids":["CVE-2026-5497"],"ecosystem":"PyPI","epss":0.00537,"exploited":false,"fixed_versions":["0.19.0"],"ghsa_id":"GHSA-wcwg-c5fc-9vrc","id":"tcs_01M5KG21893PDGX6K9AGN694G6","modified_at":"2026-08-18T20:40:58.539253503Z","published_at":"2026-06-11T12:32:44Z","references":["https://osv.dev/vulnerability/GHSA-wcwg-c5fc-9vrc","https://nvd.nist.gov/vuln/detail/CVE-2026-5497","https://github.com/vllm-project/vllm/commit/58ee61422169ce17e08248f8efa1e9df434fe395","https://access.redhat.com/errata/RHSA-2026:33524","https://access.redhat.com/errata/RHSA-2026:33531","https://access.redhat.com/security/cve/CVE-2026-5497","https://bugzilla.redhat.com/show_bug.cgi?id=2487813","https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-2302.yaml","https://github.com/vllm-project/vllm","https://huntr.com/bounties/7bd92629-b396-4449-8f88-6c0092530eb4","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5497.json"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-wcwg-c5fc-9vrc","url":"https://osv.dev/vulnerability/GHSA-wcwg-c5fc-9vrc"}],"summary":"vLLM is vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method"}