CVE-2026-115914: vLLM DeepSeek-OCR image processing vulnerable to denial of service
vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalized pixels sum to zero when that image is alone in its per-step encoder batch. parseandvalidateimageinput returns no embedding, embedmultimodal propagates that value, and sanitycheckmmencoderoutputs triggers a fatal assertion that shuts down the engine for all users. This issue is fixed in version 0.32.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vLLMto a version that resolves this vulnerability.Fixed in 0.32.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
vLLM deployments running versions from 0.11.1 before 0.32.0 are affected when they serve DeepSeek-OCR, DeepSeek-OCR-2, or Unlimited-OCR and expose an OpenAI-compatible API reachable by a remote client.
What access does an attacker need to trigger the crash?
The attacker needs network access to the OpenAI-compatible API and the ability to submit an image request. No user interaction is required, but the malicious legal image must be alone in its per-step encoder batch.
What is the operational impact of successful exploitation?
The crafted image causes a fatal assertion in the engine, shutting down vLLM for all users. The provided vector indicates availability impact only; no confidentiality or integrity impact is specified.
How can this issue be remediated?
Upgrade vLLM to version 0.32.0, which fixes the issue.