CVE-2026-115914

vLLM OCR image handling can terminate the serving engine

vLLM project · vLLM DeepSeek-OCR, DeepSeek-OCR-2 and Unlimited-OCR

First documented disclosure · Review checkpoint

Summary

A valid image with a particular normalized pixel distribution could trigger a fatal engine assertion.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

An image-validation shortcut incorrectly treated zero-sum image tensors as absent data and returned no embedding.

Conditions required

A caller can reach an affected OCR model endpoint and the trigger image is alone in its per-step encoder batch.

Potential impact

Denial of service for all users of the affected serving instance until restart.

Affected versions and configurations

0.11.1 through versions before 0.32.0.

Fix and mitigation status

0.32.0.

Practical next steps

Upgrade; isolate malformed-input failures to individual requests and supervise serving availability.

Operating lesson

Valid input must not be able to turn a model-specific error into a shared engine failure.

Evidence and limits

Public September 30 patch predates October 20 advisory and October 26 CVE publication. Researchers reproduced the failure with a real model in a controlled container; this is not evidence of a customer attack.

Sources