# vLLM M-RoPE Pure Prompt-Embeds DoS Attempt

- **Severity:** High
- **Signature ID:** `7b3f2a91-5c4d-4e8a-9f21-6d0c8b7a4e13`

## Summary

A specially crafted API request can crash a self-hosted vLLM inference server in one shot. The request sends only a precomputed embedding tensor with no accompanying text prompt, which triggers an internal assertion failure and kills the entire inference process for everyone using that server.

## How the attack works

An attacker with API access sends an HTTP POST to the vLLM /v1/completions endpoint. The request body contains a large base64-encoded tensor in the prompt_embeds field but omits any text or token-id prompt. If the server is running a model with multimodal rotary position embeddings (M-RoPE, such as Qwen2-VL or Qwen2.5-VL), this pure-embeds input trips an internal assertion in vLLM's EngineCore and the process terminates. Because the whole engine crashes, every user of that server loses service, not just the attacker.

## Why it matters

A single authenticated API call can take down an entire self-hosted vLLM inference service, causing an outage for all users of that deployment until the process is restarted.

## What you can do

- Upgrade vLLM past the affected 0.12.0-0.23.x range once a fix is available, or check release notes for this specific assertion failure.
- If you serve M-RoPE models (Qwen2-VL/Qwen2.5-VL class), reject or validate completions requests that contain prompt_embeds without an accompanying prompt.
- Restrict who can call the /v1/completions endpoint directly and require authentication for any inference API exposed beyond trusted internal use.
- Monitor for repeated inference-server crashes or restarts and correlate them with recent request bodies to catch this pattern early.

## Known benign look-alikes

- Legitimate soft-prompt / prefix-tuning workflows that intentionally submit only precomputed embeddings to a self-hosted vLLM server. These are functionally identical on the wire; only the target model (M-RoPE vs. text-only) decides whether the server crashes, and the model config is not visible in the request.
- Retrieval or embedding-conditioned generation pipelines that pass a cached tensor instead of text for latency reasons.
- Internal benchmarking, load-testing, or upgrade-regression suites that replay a prompt_embeds payload to confirm a vLLM instance has been patched.
- Security teams reproducing the advisory against a lab instance.

## References

- https://github.com/vllm-project/vllm/security/advisories
- https://docs.vllm.ai/en/latest/serving/openai_compatible_server.html
- https://owasp.org/Top10/A08_2025-Software_and_Data_Integrity_Failures/

---
Source: https://www.netzilo.com/threats/vllm-mrope-prompt-embeds-dos