← Vulnerability feed

Vulnerability record · CVE-2026-55514 · published 6 July 2026

CVE-2026-55514: Vllm vulnerability

Vllm · Vllm

vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload in a /v1/completions request with a model using M-RoPE causes EngineCore to fail an assertion and fatally crash, shutting down the entire server application. Any remote user who is authorized to make a /v1/completions request can make such a request and induce a crash. This issue is fixed in version 0.24.0.

7.1 CVSS 4.0 High EPSS 0.66% · top 50.2% CWE-617 · CWE-617
7.1CVSS 4.0 base score
0.66%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
7 Jul 2026Last modified by NVD

Description

vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload in a /v1/completions request with a model using M-RoPE causes EngineCore to fail an assertion and fatally crash, shutting down the entire server application. Any remote user who is authorized to make a /v1/completions request can make such a request and induce a crash. This issue is fixed in version 0.24.0.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/vllm-project/vllm/commit/470229c37efaf69c86e8bc97482b0b1ff7551c65 Patch
https://github.com/vllm-project/vllm/pull/45252 Issue TrackingPatch
https://github.com/vllm-project/vllm/releases/tag/v0.24.0 Release Notes
https://github.com/vllm-project/vllm/security/advisories/GHSA-33cg-gxv8-3p8g Vendor Advisory

Track CVE-2026-55514 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-25960Vllm server-side request forgery (ssrf) vulnerabilityvLLM is an inference and serving engine for large language models (LLMs). The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in…EPSS 0.72%9.8CVE-2026-22778Vllm sensitive information in log file vulnerabilityvLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multim…EPSS 3.8%9.8CVE-2026-22807Vllm code injection vulnerabilityvLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging …EPSS 0.83%9.8CVE-2025-47277Vllm deserialization of untrusted data vulnerabilityvLLM, an inference and serving engine for large language models (LLMs), has an issue in versions 0.6.5 through 0.8.4 that ONLY impacts environments u…EPSS 0.96%9.8CVE-2025-32444Vllm deserialization of untrusted data vulnerabilityvLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and prior to 0.8.5, having vLLM in…EPSS 1.8%9.8CVE-2024-11041Vllm deserialization of untrusted data vulnerabilityvllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. The function uses pickle.loads to parse receive…EPSS 1.6%9.1CVE-2026-48746Vllm http request smuggling vulnerabilityvLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette'…EPSS 1.2%9.0CVE-2025-29783Vllm deserialization of untrusted data vulnerabilityvLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization…EPSS 0.73%

Source: NIST National Vulnerability Database (record CVE-2026-55514), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.