CVE-2026-55514 vllm-project CVE debrief

Who should care

Users of the vLLM library for LLM inference and serving, especially those using versions between 0.12.0 and 0.24.0, should be aware of this vulnerability and take steps to mitigate it. This includes updating to version 0.24.0 or later, restricting access to the /v1/completions endpoint, and monitoring for suspicious activity.

Technical summary

The vLLM library for LLM inference and serving has a vulnerability that allows remote users to induce a crash via a /v1/completions request with a model using M-RoPE. This issue arises from a failure in the EngineCore assertion when a pure prompt embeds payload in the request. The vulnerability is fixed in version 0.24.0. Affected users should update to this version or later to prevent exploitation. The vulnerability has a CVSS score of 7.1 and is classified as HIGH severity.

Defensive priority

High priority should be given to updating the vLLM library to version 0.24.0 or later to prevent exploitation of this vulnerability. Additionally, users should review and implement compensating controls, monitor for suspicious activity, and track exceptions to ensure the security of their systems.

Recommended defensive actions

• Update the vLLM library to version 0.24.0 or later
• Restrict access to the /v1/completions endpoint to authorized users only
• Monitor for suspicious activity on the /v1/completions endpoint
• Implement additional security measures to prevent exploitation of this vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-06T21:16:57.207Z and was last modified on 2026-07-07T19:02:37.753Z. The NVD entry is currently Analyzed. This information is based on the provided source corpus and may not reflect the full scope of the vulnerability. Users should verify the details with the official CVE record and NVD entry for the most accurate and up-to-date information.

Official resources