{"action":"Upgrade vllm to 0.24.0 or later.","affected":[{"fixed":"0.24.0","introduced":"0.12.0"}],"component":"vllm","cve_ids":["CVE-2026-55514"],"ecosystem":"PyPI","epss":0.00665,"exploited":false,"fixed_versions":["0.24.0"],"ghsa_id":"GHSA-33cg-gxv8-3p8g","id":"tcs_01M5KGYNBQ2SYM9EVB0S98YXC5","modified_at":"2026-07-13T07:15:46.624479183Z","published_at":"2026-07-06T21:16:57.207Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2303","https://github.com/vllm-project/vllm/releases/tag/v0.24.0","https://github.com/vllm-project/vllm/security/advisories/GHSA-33cg-gxv8-3p8g","https://github.com/vllm-project/vllm/commit/470229c37efaf69c86e8bc97482b0b1ff7551c65","https://github.com/vllm-project/vllm/pull/45252"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-2303","url":"https://osv.dev/vulnerability/PYSEC-2026-2303"}],"summary":"vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload in a /v1/completions request with a model using M-RoPE causes EngineCore to fail an"}