Memory Corruption in vLLM LLM Inference Library

Executive Summary

The vulnerability exists in the vLLM library versions from 0.12.0 to before 0.24.0. When a remote user who is authorized to make a /v1/completions request sends a pure prompt with a model using M-RoPE, it causes the EngineCore component to fail an assertion and crash fatally. This crash shuts down the entire server application.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for incoming API requests to the /v1/completions endpoint that contain a payload with prompt_embeds but no prompt_token_ids, specifically targeting models using M-RoPE. Such requests cause the EngineCore to crash due to an assertion failure.

To detect potential exploitation attempts on your system, you can inspect logs or capture network traffic for POST requests to /v1/completions where the JSON body includes "prompt": null and "prompt_embeds" with a non-null value.

Example commands to detect such requests might include:

• Using tcpdump to capture HTTP POST requests to /v1/completions (assuming traffic is unencrypted): tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/v1/completions'
• Using grep or jq on server logs to find requests with prompt=null and prompt_embeds present: grep -i 'POST /v1/completions' /path/to/access.log | grep '"prompt":null' | grep '"prompt_embeds"'
• If you have access to the application logs, look for crash reports or assertion failures related to _init_mrope_positions or EngineCore crashes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the entire server application running the vLLM library to crash and shut down unexpectedly. Any authorized remote user can trigger this crash by sending a specially crafted request, potentially leading to denial of service and disruption of services relying on the server.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability CVE-2026-55514 is a Denial of Service (DoS) issue that causes the vLLM server application to crash when processing certain requests. It does not involve unauthorized data access, data leakage, or modification of sensitive information.

Because this vulnerability results in service disruption rather than data compromise, its direct impact on compliance with data protection standards such as GDPR or HIPAA is limited. However, availability is a component of these regulations, so repeated or prolonged denial of service could potentially affect compliance related to system availability and reliability.

No explicit information is provided in the available resources about the vulnerability's impact on compliance with common standards and regulations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the vLLM library to version 0.24.0 or later, where the issue is fixed.

Useful 0 Not Useful 0