vLLM M-RoPE Pure Prompt-Embeds DoS Attempt
A specially crafted API request can crash a self-hosted vLLM inference server in one shot. The request sends only a precomputed embedding tensor with no accompanying text prompt, which triggers an internal assertion failure and kills the entire inference process for everyone using that server.
How the attack works
An attacker with API access sends an HTTP POST to the vLLM /v1/completions endpoint. The request body contains a large base64-encoded tensor in the prompt_embeds field but omits any text or token-id prompt. If the server is running a model with multimodal rotary position embeddings (M-RoPE, such as Qwen2-VL or Qwen2.5-VL), this pure-embeds input trips an internal assertion in vLLM's EngineCore and the process terminates. Because the whole engine crashes, every user of that server loses service, not just the attacker.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7b3f2a91-5c4d-4e8a-9f21-6d0c8b7a4e13
- Severity
- High
Why it matters
A single authenticated API call can take down an entire self-hosted vLLM inference service, causing an outage for all users of that deployment until the process is restarted.
What you can do
- →Upgrade vLLM past the affected 0.12.0-0.23.x range once a fix is available, or check release notes for this specific assertion failure.
- →If you serve M-RoPE models (Qwen2-VL/Qwen2.5-VL class), reject or validate completions requests that contain prompt_embeds without an accompanying prompt.
- →Restrict who can call the /v1/completions endpoint directly and require authentication for any inference API exposed beyond trusted internal use.
- →Monitor for repeated inference-server crashes or restarts and correlate them with recent request bodies to catch this pattern early.
Known benign look-alikes
- Legitimate soft-prompt / prefix-tuning workflows that intentionally submit only precomputed embeddings to a self-hosted vLLM server. These are functionally identical on the wire; only the target model (M-RoPE vs. text-only) decides whether the server crashes, and the model config is not visible in the request.
- Retrieval or embedding-conditioned generation pipelines that pass a cached tensor instead of text for latency reasons.
- Internal benchmarking, load-testing, or upgrade-regression suites that replay a prompt_embeds payload to confirm a vLLM instance has been patched.
- Security teams reproducing the advisory against a lab instance.