SOURCE-LINKED INTELLIGENCE
GHSA-33cg-gxv8-3p8g: vLLM denial of service via prompt embeds on M-RoPE models
### Summary _Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server._ Sending a pure prompt embeds payload in a `/v1/completions` request with a model using M-RoPE causes the EngineCore to fail an assertion and fatally crash, shutting down the entire server application. Any remote user who is authorized to make a `/v1/completions` endpoint can trivially make such a request and induce a crash. ### Details _Give all details on the vulnerability. P
Read original source ↗ Open in workspace
- recordType
- vulnerability
- status
- active
- evidenceStatus
- reported
- region
- Global
Evidence & attribution
- OSV AI package advisories · 2026-07-20T19:13:07.000Z
- OSV AI package advisories · 2026-07-06T21:16:57.207Z
First collected: 2026-09-20T22:31:48.298Z. This is not the publication date.