{"id":"CVE-2026-126398","kind":"vulnerability","aliases":["CVE-2026-126398"],"related":[],"title":"vLLM: embeddings-only request crashes the engine for all clients","description":"vLLM from 0.28.0 before 0.30.0 contains a reachable assertion vulnerability in GPUModelRunner._init_xdrope_positions that allows remote attackers to crash the engine by submitting embeddings-only requests. Attackers can send a /v1/completions request containing only prompt_embeds to XD-RoPE models with --enable-prompt-embeds, terminating the EngineCore and API server for all clients.","summary":"vLLM from 0.28.0 before 0.30.0 has a reachable assertion in GPUModelRunner._init_xdrope_positions. A remote attacker who sends a /v1/completions request containing only prompt_embeds can crash the EngineCore and API server, cutting off all clients.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","llm-serving","python","self-hosted","vllm"],"not_affected_if":["default-config","non-xdrope-models"],"how_to_check":"- Check the installed vLLM version with `pip show vllm` and whether it falls in 0.28.0 up to but not including `0.30.0`.\n- Check whether the server runs with `--enable-prompt-embeds` and serves XD-RoPE models.","fix":"- vLLM: move to `0.30.0` or later (the sources state the fixed version as 0.30.0).","status":"open","published_at":"2026-11-13T10:17:44+00:00","first_seen_at":"2026-11-13T10:47:19+00:00","triaged_at":"2026-11-13T10:52:19+00:00","updated_at":"2026-11-13T10:52:19+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-13T10:52:19Z","model":"claude-haiku-5-5","output":{"fix":"- vLLM: move to `0.30.0` or later (the sources state the fixed version as 0.30.0).","reach":"internet","title":"vLLM: embeddings-only request crashes the engine for all clients","impact":"low","summary":"vLLM from 0.28.0 before 0.30.0 has a reachable assertion in GPUModelRunner._init_xdrope_positions. A remote attacker who sends a /v1/completions request containing only prompt_embeds can crash the EngineCore and API server, cutting off all clients.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["vllm","python","llm-serving","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote requests crash the inference engine and API server for everyone","analyst_note":"Check the maintainer advisory on github.com and the VulnCheck advisory to confirm the fix version and any workaround.","how_to_check":"- Check the installed vLLM version with `pip show vllm` and whether it falls in 0.28.0 up to but not including `0.30.0`.\n- Check whether the server runs with `--enable-prompt-embeds` and serves XD-RoPE models.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","non-xdrope-models"],"who_is_affected":"Only servers running vLLM 0.28.0 to before 0.30.0 with --enable-prompt-embeds enabled and an XD-RoPE model loaded are exposed. Any client that can reach the completions endpoint can trigger the crash, so the exposure is the reachable API itself. Deployments without prompt embeds enabled or without XD-RoPE models can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00079,"input_tokens":4653,"output_tokens":650,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126398':14A,17A '-2026':13A,16A '/v1/completions':46B,93C '0.28.0':31B,65C '0.30.0':33B,67C 'ai':19B 'ai-tool':18B 'allow':76C 'api':57B,113C 'assert':37B,71C 'attack':42B,78C,89C 'client':11A,62B,117C 'contain':48B,68C,95C 'crash':6A,53B,80C 'cut':59B 'cve':12A,15A 'emb':51B,98C,108C 'embed':3A,86C 'embeddings-on':2A,85C 'enabl':106C 'enable-prompt-emb':105C 'engin':8A,82C 'enginecor':55B,111C 'gpumodelrunner._init_xdrope_positions':39B,74C 'host':27B 'llm':22B 'llm-serv':21B 'model':103C 'prompt':50B,97C,107C 'python':24B 'reachabl':36B,70C 'remot':41B,77C 'request':5A,47B,88C,94C 'rope':102C 'self':26B 'self-host':25B 'send':44B,91C 'serv':23B 'server':58B,114C 'submit':84C 'termin':109C 'tool':20B 'vllm':1A,28B,29B,63C 'vulner':72C 'xd':101C 'xd-rope':100C","nicknames":[],"mitigations":[],"who_affected":"Only servers running vLLM 0.28.0 to before 0.30.0 with --enable-prompt-embeds enabled and an XD-RoPE model loaded are exposed. Any client that can reach the completions endpoint can trigger the crash, so the exposure is the reachable API itself. Deployments without prompt embeds enabled or without XD-RoPE models can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","high","llmserving","python","selfhosted","vllm"],"campaign_type":null,"search_a":"'-126398':14A,17A '-2026':13A,16A 'client':11A 'crash':6A 'cve':12A,15A 'embed':3A 'embeddings-on':2A 'engin':8A 'request':5A 'vllm':1A","search_b":"'/v1/completions':46B '0.28.0':31B '0.30.0':33B 'ai':19B 'ai-tool':18B 'api':57B 'assert':37B 'attack':42B 'client':62B 'contain':48B 'crash':53B 'cut':59B 'emb':51B 'enginecor':55B 'gpumodelrunner._init_xdrope_positions':39B 'host':27B 'llm':22B 'llm-serv':21B 'prompt':50B 'python':24B 'reachabl':36B 'remot':41B 'request':47B 'self':26B 'self-host':25B 'send':44B 'serv':23B 'server':58B 'tool':20B 'vllm':28B,29B","search_c":"'/v1/completions':93C '0.28.0':65C '0.30.0':67C 'allow':76C 'api':113C 'assert':71C 'attack':78C,89C 'client':117C 'contain':68C,95C 'crash':80C 'emb':98C,108C 'embed':86C 'embeddings-on':85C 'enabl':106C 'enable-prompt-emb':105C 'engin':82C 'enginecor':111C 'gpumodelrunner._init_xdrope_positions':74C 'model':103C 'prompt':97C,107C 'reachabl':70C 'remot':77C 'request':88C,94C 'rope':102C 'send':91C 'server':114C 'submit':84C 'termin':109C 'vllm':63C 'vulner':72C 'xd':101C 'xd-rope':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T22:18:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126398","severity":null,"published_at":"2026-11-13T10:17:44+00:00","modified_at":"2026-11-13T10:17:44+00:00","first_seen_at":"2026-11-13T10:47:19+00:00","fetched_at":"2026-11-13T10:47:19+00:00","note":null}],"documents":[{"id":110586,"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-5q78-j82c-2vr2","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-10-27T22:18:41+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145040,"url":"https://www.vulncheck.com/advisories/vllm-0.28.0-before-0.30.0-denial-of-service-via-prompt-embeds-on-xd-rope-models","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}