{"action":"Upgrade vllm to 0.19.0 or later.","affected":[{"fixed":"0.19.0","introduced":"0.8.0"}],"component":"vllm","cve_ids":["CVE-2026-5497"],"ecosystem":"PyPI","epss":0.00537,"exploited":false,"fixed_versions":["0.19.0"],"ghsa_id":"GHSA-wcwg-c5fc-9vrc","id":"tcs_01M5KGYN6B9QC0CTDFHWVA433M","modified_at":"2026-08-19T12:15:03.324111672Z","published_at":"2026-06-11T10:16:21.903Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2302","https://access.redhat.com/security/cve/CVE-2026-5497","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5497.json","https://bugzilla.redhat.com/show_bug.cgi?id=2487813","https://github.com/vllm-project/vllm/commit/58ee61422169ce17e08248f8efa1e9df434fe395","https://huntr.com/bounties/7bd92629-b396-4449-8f88-6c0092530eb4","https://github.com/advisories/GHSA-wcwg-c5fc-9vrc"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-2302","url":"https://osv.dev/vulnerability/PYSEC-2026-2302"}],"summary":"vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processin"}