vLLM versions 0.12.0 through before 0.24.0 contain a flaw triggered by sending a pure prompt‑embeds payload with a /v1/completions request when the chosen model incorporates M‑RoPE. The EngineCore component fails an internal assertion, causing the entire server process crash and terminate. This results in a service outage without affecting confidentiality or integrity. The weakness is classified as CWE‑617, an improper restriction of operations within the bounds of a memory buffer.

The vllm library from the vllm‑project is impacted. All releases from 0.12.0 up to, but excluding, 0.24.0 that employ a model using M‑RoPE are vulnerable. Users running the library in a server context with exposed /v1/completions endpoints bear the risk.

The CVSS score of 7.1 indicates a moderate‑to‑high severity. Because the vulnerability is not listed in CISA KEV and its EPSS score is <1%, the likelihood of exploitation is uncertain, but any authorized client that can invoke the /v1/completions endpoint can craft the specific prompt‑embeds payload and force a crash. The attack requires only authentication to the endpoint, which is common in typical deployment scenarios, making the exposure significant for services without additional safeguards.