AI Threat Alert
vLLM's inference server can be crashed by any authorized user who sends a specially crafted prompt embeddings payload to the /v1/completions endpoint against a model configured with M-RoPE (used by multi-modal/vision-language models), triggering an unhandled assertion failure in EngineCore that takes down the entire server process. With 129 downstream dependents and vLLM being one of the most widely deployed open-source LLM inference engines, the blast radius of a single crashed instance in a multi-tenant or shared-serving deployment is significant — every user of that server loses service, not just the requester. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this is not being actively exploited in the wild, but the attack requires only low privileges, no user interaction, and low complexity (CVSS 6.5, AV:N/AC:L/PR:L), meaning any already-authenticated API consumer — including a low-trust or compromised downstream integration — can trigger it. Patch to vLLM 0.24.0 immediately if you run M-RoPE-capable models (e.g., Qwen2-VL family) in production, and until patched, monitor for repeated EngineCore crash/restart cycles as a detection signal and consider restricting or validating prompt_embeds input on the completions endpoint.
What is the risk?
This is a pure availability vulnerability (C:N/I:N/A:H) with no confidentiality or integrity impact — it cannot be used to exfiltrate data or manipulate model output. However, the low attack complexity, network vector, and low privilege requirement mean it is trivially reachable by any client with API access, including third-party integrations or lower-trust service accounts that legitimately call the completions endpoint. The lack of EPSS scoring and absence from CISA KEV suggest low current exploitation interest, but the simplicity of the trigger (a single crafted request) and the severity of the outcome (full server crash, not just request-level failure) make this a realistic operational risk for any organization running vLLM with M-RoPE-enabled models in a shared or production-facing environment. Risk is elevated for multi-tenant inference platforms where one low-privilege user can deny service to all others sharing the same EngineCore instance.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| vLLM | pip | >= 0.12.0, < 0.24.0 | 0.24.0 |
Do you use vLLM? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
Upgrade to vLLM 0.24.0 or later immediately, where this issue is fixed. Until patched, if you serve M-RoPE models, consider restricting /v1/completions access to trusted, rate-limited clients only, and disable or gate use of the prompt_embeds parameter for untrusted callers if your deployment does not require it. For detection, monitor process-level restarts/crash-loop signals on EngineCore and alert on repeated unexpected server restarts correlated with completions requests to M-RoPE-backed models. Review API key/service account scoping so low-privilege integrations cannot single-handedly disrupt shared inference capacity.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-55514?
vLLM's inference server can be crashed by any authorized user who sends a specially crafted prompt embeddings payload to the /v1/completions endpoint against a model configured with M-RoPE (used by multi-modal/vision-language models), triggering an unhandled assertion failure in EngineCore that takes down the entire server process. With 129 downstream dependents and vLLM being one of the most widely deployed open-source LLM inference engines, the blast radius of a single crashed instance in a multi-tenant or shared-serving deployment is significant — every user of that server loses service, not just the requester. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this is not being actively exploited in the wild, but the attack requires only low privileges, no user interaction, and low complexity (CVSS 6.5, AV:N/AC:L/PR:L), meaning any already-authenticated API consumer — including a low-trust or compromised downstream integration — can trigger it. Patch to vLLM 0.24.0 immediately if you run M-RoPE-capable models (e.g., Qwen2-VL family) in production, and until patched, monitor for repeated EngineCore crash/restart cycles as a detection signal and consider restricting or validating prompt_embeds input on the completions endpoint.
Is CVE-2026-55514 actively exploited?
No confirmed active exploitation of CVE-2026-55514 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-55514?
Upgrade to vLLM 0.24.0 or later immediately, where this issue is fixed. Until patched, if you serve M-RoPE models, consider restricting /v1/completions access to trusted, rate-limited clients only, and disable or gate use of the prompt_embeds parameter for untrusted callers if your deployment does not require it. For detection, monitor process-level restarts/crash-loop signals on EngineCore and alert on repeated unexpected server restarts correlated with completions requests to M-RoPE-backed models. Review API key/service account scoping so low-privilege integrations cannot single-handedly disrupt shared inference capacity.
What systems are affected by CVE-2026-55514?
This vulnerability affects the following AI/ML architecture patterns: model serving, multi-modal inference, agent frameworks.
What is the CVSS score for CVE-2026-55514?
CVE-2026-55514 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.37%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0029 Denial of AI Service AML.T0040 AI Model Inference API Access AML.T0049 Exploit Public-Facing Application Compliance Controls Affected
What are the technical details?
Original Advisory
vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload in a /v1/completions request with a model using M-RoPE causes EngineCore to fail an assertion and fatally crash, shutting down the entire server application. Any remote user who is authorized to make a /v1/completions request can make such a request and induce a crash. This issue is fixed in version 0.24.0.
Exploitation Scenario
An adversary who holds a low-privilege API key for a vLLM-backed inference service (e.g., a compromised or intentionally limited third-party integration account) identifies that the target server is running an M-RoPE-capable model. They send a single /v1/completions request containing a malformed prompt_embeds payload crafted to violate an internal assertion in EngineCore's M-RoPE handling. The assertion failure crashes the EngineCore process, taking down the entire vLLM server — denying inference service to every other user, application, or downstream agent relying on that instance, effectively a one-shot denial-of-service attack requiring no more than standard API access.
Weaknesses (CWE)
CWE-617 — Reachable Assertion: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
- [Implementation] Make sensitive open/close operation non reachable by directly user-controlled data (e.g. open/close resources)
- [Implementation] Perform input validation on user data.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H References
- github.com/advisories/GHSA-33cg-gxv8-3p8g
- github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-2303.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-55514
- github.com/vllm-project/vllm/commit/470229c37efaf69c86e8bc97482b0b1ff7551c65
- github.com/vllm-project/vllm/pull/45252
- github.com/vllm-project/vllm/releases/tag/v0.24.0
- github.com/vllm-project/vllm/security/advisories/GHSA-33cg-gxv8-3p8g
Timeline
Related Vulnerabilities
CVE-2024-9053 9.8 vllm: RCE via unsafe pickle deserialization in RPC server
Same package: vllm CVE-2024-11041 9.8 vllm: RCE via unsafe pickle deserialization in MessageQueue
Same package: vllm CVE-2025-47277 9.8 vLLM: RCE via exposed TCPStore in distributed inference
Same package: vllm CVE-2026-25960 9.8 vllm: SSRF allows internal network access
Same package: vllm CVE-2025-32444 9.8 vLLM: RCE via pickle deserialization on ZeroMQ
Same package: vllm