By vendor

Vllm vulnerabilities

Known CVEs affecting Vllm products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-5497HIGH 7.5

  vLLM, an open-source large language model inference engine, contains a denial-of-service vulnerability in how it processes video data. When an attacker sends a specially crafted request containing thousands of JPEG images bundled into a single data URL, the server attempts to decode all of them into memory simultaneously, exhausting available RAM and crashing the service. No authentication is required—the attack works against any exposed vLLM instance running versions 0.8.0 and later. The vulnerability stems from the absence of limits on how many frames the system will process from a single request.