Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-115914— vLLM DeepSeek-OCR image processing vulnerable to denial of service

Quick assessment

Affected

vllm-project vllm

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

vLLM 是一个用于大语言模型的推理与服务引擎。在 0.11.1 至 0.32.0 版本中，DeepSeek-OCR、DeepSeek-OCR-2 和 Unlimited-OCR 的图像路径存在漏洞：若远程客户端能够访问 OpenAI 兼容 API，则可能提交一张合法图像，该图像在单独处于其每步编码器批次中时，归一化后的像素值之和为零。此时，函数未返回任何嵌入向量，函数会将该空值继续传递，最终导致触发致命断言，使整个引擎对所有用户停止服务。该问题已在 0.32.0 版本中修复。

CVSS 6.5 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

vLLM DeepSeek-OCR image processing vulnerable to denial of service

Source: CVE Program / CVE List V5

Vulnerability Description

vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalized pixels sum to zero when that image is alone in its per-step encoder batch. _parse_and_validate_image_input returns no embedding, embed_multimodal propagates that value, and sanity_check_mm_encoder_outputs triggers a fatal assertion that shuts down the engine for all users. This issue is fixed in version 0.32.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

可达断言

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
vllm-project	vllm	>= 0.11.1, < 0.32.0	-

II. Public POCs for CVE-2026-115914

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115914

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-115914 (2)

Vendor Advisories for CVE-2026-115914 (1)

🔗 DeepSeek-OCR family: an image whose normalized pixels sum to exactly 0 makes embed_multimodal return None, tripping the encoder-output sanity assert — one unauthenticated request kills the whole vLLM engine (default config) · Advisory · vllm-project/vllm · GitHub x_refsource_CONFIRM

Vendor Pages for CVE-2026-115914 (1)

🔗 Release v0.32.0 · vllm-project/vllm · GitHub Read full article x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-115914

Same Patch Batch · vllm-project · 2026-10-26 · 8 CVEs total

CVE-2026-115915	8.1 HIGH	vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
CVE-2026-115912	7.5 HIGH	vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insec
CVE-2026-115911	6.5 MEDIUM	vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
CVE-2026-115913	6.5 MEDIUM	vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a s
CVE-2026-115916	6.5 MEDIUM	vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device
CVE-2026-115918	6.5 MEDIUM	vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
CVE-2026-115917	3.4 LOW	vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

IV. Related Vulnerabilities

Same product: vllm

Same vendor: vllm-project

Same weakness: CWE-617