CVE-2026-115914

vLLM DeepSeek-OCR image processing vulnerable to denial of service

Published Oct 26, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalized pixels sum to zero when that image is alone in its per-step encoder batch. _parse_and_validate_image_input returns no embedding, embed_multimodal propagates that value, and sanity_check_mm_encoder_outputs triggers a fatal assertion that shuts down the engine for all users. This issue is fixed in version 0.32.0.

Analysis

Technical impact

A remote user who can access the OpenAI-compatible API can submit a specially crafted image whose normalized pixel values sum to zero. In vLLM versions 0.11.1 through 0.32.0, the image path handling for DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR does not produce an embedding for such an image, causing a chain of calls that eventually triggers a fatal assertion in sanity_check_mm_encoder_outputs. The assertion aborts the entire engine, resulting in a denial of service for all clients with no authentication or privilege escalation required.

Affected Systems

Vulnerable editions of the vLLM inference engine, specifically versions 0.11.1 up to, but not including, 0.32.0, expose the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image endpoints. Any deployment that allows external clients to invoke the OpenAI‑compatible API and transmit image data is at risk. The fix was released in v0.32.0.

Risk and Exploitability

The CVSS score of 6.5 classifies the flaw as moderate severity, while the EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog. The lack of authentication or privilege checks means the attack can be conducted by any remote party that can reach the API, making the exploit likelihood higher than for more restricted flaws. The denial of service affects all users of the engine, and the attack does not compromise confidentiality or integrity beyond service interruption.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

vllm-project

vllm

affected

Version	Status	Constraints
`>= 0.11.1, < 0.32.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Vllm

Version	Status	Scheme	Platform
`[0.11.1,0.32.0)`	affected	semver	—

Vllm-project

Vllm

Version	Status	Scheme	Platform
`[0.11.1,0.32.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade vllm to version 0.32.0 or later, which contains the image handling fix.
Restart the service to apply the updated binaries and clear any cached state.
Until the upgrade can be performed, restrict external API access to trusted hosts or use a firewall to block unauthenticated traffic.

Generated by OpenCVE AI on October 26, 2026 at 18:25 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-gq5q-89c7-vhvx	vLLM DeepSeek-OCR image processing vulnerable to denial of service

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.397% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/vllm-project/vllm/commit/c15672cfb49152ebf65cfd188e71b84593ec5686
https://github.com/vllm-project/vllm/pull/59417
https://github.com/vllm-project/vllm/releases/tag/v0.32.0
https://github.com/vllm-project/vllm/security/advisories/GHSA-gq5q-89c7-vhvx
https://nvd.nist.gov/vuln/detail/CVE-2026-115914
https://www.cve.org/CVERecord?id=CVE-2026-115914

History

Oct 30, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 28, 2026 3:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:vllm:vllm::::::::

Oct 27, 2026 12:30 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-115914 https://www.cve.org/CVERecord?id=CVE-2026-115914
Metrics	threat_severity `None`	threat_severity `Moderate`

Oct 26, 2026 6:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Vllm Vllm vllm Vllm-project Vllm-project vllm
Vendors & Products		Vllm Vllm vllm Vllm-project Vllm-project vllm

Oct 26, 2026 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalized pixels sum to zero when that image is alone in its per-step encoder batch. _parse_and_validate_image_input returns no embedding, embed_multimodal propagates that value, and sanity_check_mm_encoder_outputs triggers a fatal assertion that shuts down the engine for all users. This issue is fixed in version 0.32.0.
Title		vLLM DeepSeek-OCR image processing vulnerable to denial of service
Weaknesses		CWE-617
References		https://github.com/vllm-project/vllm/commit/c15672cfb49152ebf65cfd188e71b84593ec5686 https://github.com/vllm-project/vllm/pull/59417 https://github.com/vllm-project/vllm/releases/tag/v0.32.0 https://github.com/vllm-project/vllm/security/advisories/GHSA-gq5q-89c7-vhvx
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`