CVE-2026-126398

The vLLM library (versions 0.28.0 to 0.30.0 ) contains a reachable assertion vulnerability in the GPUModelRunner._init_xdrope_positions component. This flaw allows remote attackers to cause a Denial of Service (DoS) by submitting specific embeddings-only requests. Specifically, an attacker can se...