GHSA-5q78-j82c-2vr2: vLLM 0.28.0 before 0.30.0 Denial of Service via Prompt Embeds on XD-RoPE Models
vLLM from 0.28.0 before 0.30.0 contains a reachable assertion vulnerability in GPUModelRunner.initxdropepositions that allows remote attackers to crash the engine by submitting embeddings-only requests. Attackers can send a /v1/completions request containing only promptembeds to XD-RoPE models with --enable-prompt-embeds, terminating the EngineCore and API server for all clients.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.30.0
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Deployments using vLLM versions from 0.28.0 up to, but not including, 0.30.0 are affected when serving XD-RoPE models with --enable-prompt-embeds enabled.
What must an attacker do to trigger the crash?
An unauthenticated remote attacker must be able to submit a /v1/completions request. The triggering request contains only prompt_embeds.
What is the operational impact of successful exploitation?
The request triggers a reachable assertion in GPUModelRunner._init_xdrope_positions, terminating the EngineCore and API server. This denies service to all clients using that server.