{"data":{"id":"2ba12c77-2687-43c7-adbc-0c285e06e34b","title":"CVE-2026-55514: vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload in…","summary":"CVE-2026-55514 affects vLLM, a library for LLM inference and serving, in versions from 0.12.0 to before 0.24.0. Sending a pure prompt embeds payload in a /v1/completions request to a model using M-RoPE makes EngineCore fail an assertion and crash, shutting down the entire server application. Any remote user authorized to make a /v1/completions request can trigger it.","solution":"This issue is fixed in version 0.24.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55514","publishedAt":"2026-07-06T21:16:57.207Z","cveId":"CVE-2026-55514","cweIds":["CWE-617"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["vllm@>= 0.12.0, < 0.24.0 (fixed: 0.24.0)"],"affectedPackageNames":["vllm"],"affectedPackageRefs":["pypi:vllm"],"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM crash via pure prompt embeds in /v1/completions requests","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00665,"epssCheckedAt":"2026-10-14T06:09:05.631Z","kevDateAdded":null,"advisoryAliases":["GHSA-33cg-gxv8-3p8g"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:47:00.558Z","patchAvailable":true,"disclosureDate":"2026-07-06T21:16:57.207Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}