Executive brief
vLLM is a high-throughput engine for serving large language models. A vulnerability exists where an authorized user can crash the entire server by sending a specific type of request to the completions endpoint when using models that support Multimodal Rotary Positional Embedding (M-RoPE). This results in a complete denial of service, requiring a manual restart of the application to restore operations.
Technical details
A denial of service vulnerability exists in vLLM's GPUModelRunner due to an incorrect assertion in the _init_mrope_positions method. When a request is sent to the /v1/completions endpoint with prompt_embeds provided but prompt=None, the EngineCore fails a type-narrowing assertion that expects prompt_token_ids to be present. This failure triggers an unhandled AssertionError, causing the EngineCore and the APIServer to crash. The issue affects configurations where --enable-prompt-embeds is active and an M-RoPE-supported model is in use. A fix is available in version 0.24.0 which replaces the fatal assertion with logic to handle embedding-only inputs using dummy token IDs.
Affected products
- vllm-project vllm >= 0.12.0, < 0.24.0
Timeline
- 2026-07-02: disclosed
- 2026-07-20: advisory: Last updated date
References
- https://api.github.com/users/qthequartermasterman
- https://github.com/qthequartermasterman
- https://api.github.com/users/qthequartermasterman/gists%7B/gist_id%7D
- https://api.github.com/users/qthequartermasterman/repos
- https://avatars.githubusercontent.com/u/19497738?v=4
- https://api.github.com/users/qthequartermasterman/events%7B/privacy%7D