CVE-2026-126398: vLLM 0.28.0 before 0.30.0 Denial of Service via Prompt Embeds on XD-RoPE Models
vLLM from 0.28.0 before 0.30.0 contains a reachable assertion vulnerability in GPUModelRunner.initxdropepositions that allows remote attackers to crash the engine by submitting embeddings-only requests. Attackers can send a /v1/completions request containing only promptembeds to XD-RoPE models with --enable-prompt-embeds, terminating the EngineCore and API server for all clients.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.30.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Deployments running vLLM from 0.28.0 up to, but not including, 0.30.0 are exposed when serving XD-RoPE models with --enable-prompt-embeds enabled. The affected request path is the /v1/completions API.
What does an attacker need to do to trigger the crash?
An unauthenticated remote attacker needs to submit a /v1/completions request containing only prompt_embeds. No user interaction or privileges are required, although the attack complexity is rated high.
What is the operational impact of successful exploitation?
The crafted request triggers a reachable assertion in GPUModelRunner._init_xdrope_positions, terminating the EngineCore and API server. This causes denial of service for all clients using that server.
How can I determine whether my instance is affected?
Check whether the instance runs an affected vLLM version, serves an XD-RoPE model, and was started with --enable-prompt-embeds. If all of these conditions apply, its /v1/completions endpoint can be crashed with an embeddings-only request.