{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/vllm--0.12.0--0.24.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.5,"id":"CVE-2026-55514"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["vLLM (\u003e= 0.12.0, \u003c 0.24.0)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vllm","large-language-model","cve"],"_cs_type":"advisory","_cs_vendors":["vLLM"],"content_html":"\u003cp\u003eA critical denial of service vulnerability, identified as CVE-2026-55514, affects vLLM versions 0.12.0 through 0.23.x. The flaw arises when a vLLM server is configured with \u003ccode\u003e--enable-prompt-embeds\u003c/code\u003e and is running a model that utilizes M-RoPE (Multi-head Rotational Position Embedding). An authorized remote user can exploit this vulnerability by sending an HTTP POST request to the \u003ccode\u003e/v1/completions\u003c/code\u003e endpoint with a JSON payload where the \u003ccode\u003eprompt\u003c/code\u003e field is explicitly set to \u003ccode\u003enull\u003c/code\u003e and the \u003ccode\u003eprompt_embeds\u003c/code\u003e field contains any non-null data. This specific combination bypasses expected conditions within the \u003ccode\u003e_init_mrope_positions\u003c/code\u003e method in \u003ccode\u003eGPUModelRunner.py\u003c/code\u003e, causing an assertion \u003ccode\u003ereq_state.prompt_token_ids is not None\u003c/code\u003e to fail. The assertion failure results in a fatal crash of the EngineCore, leading to the complete shutdown of the vLLM server application. This attack is described as \u0026quot;extremely easy\u0026quot; to perform and can be triggered by nearly verbatim examples from the official \u003ccode\u003eprompt_embeds\u003c/code\u003e documentation, accounting for model and connection details.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a vulnerable vLLM server instance (versions 0.12.0 to 0.23.x) configured with \u003ccode\u003e--enable-prompt-embeds\u003c/code\u003e and running an M-RoPE-supported model.\u003c/li\u003e\n\u003cli\u003eThe attacker obtains authorization to make requests to the \u003ccode\u003e/v1/completions\u003c/code\u003e endpoint on the target vLLM server.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP POST request targeting the \u003ccode\u003e/v1/completions\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eWithin the request's JSON body, the attacker sets the \u003ccode\u003eprompt\u003c/code\u003e field to \u003ccode\u003enull\u003c/code\u003e and provides non-null data for the \u003ccode\u003eprompt_embeds\u003c/code\u003e field.\u003c/li\u003e\n\u003cli\u003eThe vLLM server receives and begins processing the specially crafted \u003ccode\u003e/v1/completions\u003c/code\u003e request.\u003c/li\u003e\n\u003cli\u003eDuring processing, the \u003ccode\u003e_init_mrope_positions\u003c/code\u003e method in \u003ccode\u003eGPUModelRunner.py\u003c/code\u003e is invoked.\u003c/li\u003e\n\u003cli\u003eThe method attempts to execute an assertion \u003ccode\u003eassert req_state.prompt_token_ids is not None\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDue to the attacker's payload setting \u003ccode\u003eprompt=null\u003c/code\u003e, \u003ccode\u003ereq_state.prompt_token_ids\u003c/code\u003e is \u003ccode\u003eNone\u003c/code\u003e, causing the assertion to fail and the EngineCore to fatally crash, resulting in a denial of service for the entire application.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability leads to a complete denial of service for affected vLLM server applications. Any configuration where \u003ccode\u003e--enable-prompt-embeds\u003c/code\u003e is active and an M-RoPE-supported model is in use is vulnerable. An authorized remote attacker can trivially trigger this assertion failure, causing the EngineCore to crash and shutting down the entire server. This results in unavailability of the large language model service, disrupting any applications or users relying on it. The ease of exploitation means that systems are at high risk if left unpatched. There are no reported specific victim counts, but any organization using the affected vLLM versions could be targeted.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade vLLM to version 0.24.0 or later immediately to patch CVE-2026-55514.\u003c/li\u003e\n\u003cli\u003eMonitor vLLM server logs for unexpected assertion failures or fatal EngineCore crashes, particularly those indicating \u003ccode\u003eAssertionError: M-RoPE requires prompt_token_ids to be available.\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, consider implementing network-level filtering or WAF rules to detect and block HTTP POST requests to \u003ccode\u003e/v1/completions\u003c/code\u003e that contain a JSON body with \u003ccode\u003eprompt: null\u003c/code\u003e and a non-null \u003ccode\u003eprompt_embeds\u003c/code\u003e field.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T19:14:15Z","date_published":"2026-07-20T19:14:15Z","id":"https://feed.craftedsignal.io/briefs/2026-07-vllm-dos/","summary":"A denial of service vulnerability, CVE-2026-55514, exists in vLLM versions from 0.12.0 up to, but not including, 0.24.0, allowing an authorized remote user to send a specially crafted `/v1/completions` request that leverages pure prompt embeds with an M-RoPE-enabled model to trigger an assertion failure, causing the vLLM server application to fatally crash.","title":"vLLM Denial of Service Vulnerability via M-RoPE Prompt Embeds (CVE-2026-55514)","url":"https://feed.craftedsignal.io/briefs/2026-07-vllm-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - VLLM (\u003e= 0.12.0, \u003c 0.24.0)","version":"https://jsonfeed.org/version/1.1"}