vLLM: embeddings-only request to XD-RoPE model trips assertion and kills the engine

Impact

A /v1/completions request that carries only prompt_embeds reaches an assertion in GPUModelRunner._init_xdrope_positions on XD-RoPE models. The assertion ends EngineCore and the API server, so one request takes the endpoint down for every client until it is restarted. Repeating the request keeps the GPU capacity behind it offline. The exposure is narrow: the server must run an XD-RoPE model with --enable-prompt-embeds on.

Who can reach it

Any client that can send completion requests to a vLLM 0.28.x-0.29.x server running an XD-RoPE model with --enable-prompt-embeds. No authentication unless the operator adds one in front of it.

What to do

Upgrade vLLM to 0.30.0 or later and restart the serving processes. If you cannot upgrade right away, turn off --enable-prompt-embeds on XD-RoPE deployments that do not need it. That flag is a precondition for the crash.

References

Related entries

• GitLab AI Gateway: crafted model metadata redirects model requests and discloses Vertex or Bedrock credentialsCVE-2026-19889 · GitLab AI Gateway (Duo Agent Platform model metadata handling)High
• Docker Model Runner (vllm-metal backend): `trust_remote_code=True` set unconditionally, no sandboxCVE-2026-5817 · Docker Model Runner (vllm-metal backend)High
• praktor: unsanitized Telegram upload filename writes outside uploads/ into the persistent agent workspaceCVE-2026-62331 · praktor multi-agent Claude Code orchestrator (Telegram document upload)High
• GitLab AI Gateway: crafted inline flow config overrides the HTTP Host header and leaks Vertex credentialsCVE-2026-75871 · GitLab AI Gateway (Duo Agent Platform inline flow configuration)High
• Gradio: Command injectionCVE-2023-6572 · GradioHigh
• LangChain: Directory traversal via the template path parameterCVE-2024-28088 · LangChainHigh