CVE-2026-55514
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A vulnerability in vLLM from version 0.12.0 to before 0.24.0 allows a remote, authorized user to send a /v1/completions request with a model using M-RoPE, causing an assertion failure in EngineCore and a fatal crash of the entire server.
Risk Assessment
An attacker can intentionally crash the server, leading to service disruption and potential denial of service for all users.
Recommendation
Immediately upgrade vLLM to version 0.24.0 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload in a /v1/completions request with a model using M-RoPE causes EngineCore to fail an assertion and fatally crash, shutting down the entire server application. Any remote user who is authorized to make a /v1/completions request can make such a request and induce a crash. This issue is fixed in version 0.24.0.