CVE-2026-55514: vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload in a /v1/completions request with a model using M-RoPE causes EngineCore to fail ...

Added to the CISA Known Exploited Vulnerabilities catalog on 06 Jul 2026. Vendor: AI/ML. Product: LLM. CVSS score: 6.5.

vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload in a /v1/completions request with a model using M-RoPE causes EngineCore to fail an assertion and fatally crash, shutting down the entire server application. Any remote user who is ...

Required action: Review and patch if applicable to your AI infrastructure.