CVE-2026-55514 Details
Description
vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload in a /v1/completions request with a model using M-RoPE causes EngineCore to fail an assertion and fatally crash, shutting down the entire server application. Any remote user who is authorized to make a /v1/completions request can make such a request and induce a crash. This issue is fixed in version 0.24.0.
A denial-of-service vulnerability has been identified in vLLM, a library for large language model (LLM) inference and serving. This issue affects vLLM versions 0.12.0 prior to 0.24.0. The vulnerability arises when a user sends a `/v1/completions` request with a pure prompt embeds payload, using a model that supports M-RoPE. This combination causes the EngineCore to fail an assertion, leading to a fatal crash that shuts down the entire server application. Any remote user authorized to make `/v1/completions` requests can exploit this vulnerability.
Users can upgrade to vLLM version 0.24.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-617 | Reachable Assertion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vllm vllm | >= 0.12.0, < 0.24.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jul 6, 2026 | New CVE Received | [email protected] |
| Jul 6, 2026 | CVE Modified | CISA-ADP |