{"id":"CVE-2026-115914","kind":"vulnerability","aliases":["CVE-2026-115914"],"related":[],"title":"vLLM: crafted OCR image crashes the inference engine for all users","description":"vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalized pixels sum to zero when that image is alone in its per-step encoder batch. _parse_and_validate_image_input returns no embedding, embed_multimodal propagates that value, and sanity_check_mm_encoder_outputs triggers a fatal assertion that shuts down the engine for all users. This issue is fixed in version 0.32.0.","summary":"vLLM versions from 0.11.1 up to 0.32.0 let a remote client send a specific legal image to the DeepSeek-OCR image path, which makes the serving engine hit a fatal assertion and shut down. An attacker can take the engine offline for every user of the server with one request.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","gpu-inference","llm-serving","python","self-hosted","vllm"],"not_affected_if":["api-not-reachable-by-clients","text-only-models","version-0.32.0-or-later"],"how_to_check":"- Run `python -c \"import vllm; print(vllm.__version__)\"` to read the installed vLLM version\n- Check whether the server serves DeepSeek-OCR, DeepSeek-OCR-2 or Unlimited-OCR models through the OpenAI-compatible API","fix":"- Upgrade vLLM to `0.32.0` or later\n- Until upgraded, restrict who can reach the OpenAI-compatible API endpoint","status":"open","published_at":"2026-10-26T18:17:38+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","triaged_at":"2026-10-26T18:34:03+00:00","updated_at":"2026-10-26T18:34:03+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-26T18:34:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade vLLM to `0.32.0` or later\n- Until upgraded, restrict who can reach the OpenAI-compatible API endpoint","reach":"internet","title":"vLLM: crafted OCR image crashes the inference engine for all users","impact":"medium","summary":"vLLM versions from 0.11.1 up to 0.32.0 let a remote client send a specific legal image to the DeepSeek-OCR image path, which makes the serving engine hit a fatal assertion and shut down. An attacker can take the engine offline for every user of the server with one request.","category":"ai-tooling","nicknames":[],"who_cares":["vllm","llm-serving","python","self-hosted","gpu-inference"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Engine shuts down, denying inference service to all users","analyst_note":"","how_to_check":"- Run `python -c \"import vllm; print(vllm.__version__)\"` to read the installed vLLM version\n- Check whether the server serves DeepSeek-OCR, DeepSeek-OCR-2 or Unlimited-OCR models through the OpenAI-compatible API","needs_analyst":false,"not_affected_if":["text-only-models","version-0.32.0-or-later","api-not-reachable-by-clients"],"who_is_affected":"Teams running vLLM between 0.11.1 and 0.32.0 that serve DeepSeek-OCR, DeepSeek-OCR-2 or Unlimited-OCR models and accept image input from clients that can reach the OpenAI-compatible API. Deployments that serve only text models or keep the API behind a private network are less exposed. Teams on 0.32.0 or later can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000656,"input_tokens":3413,"output_tokens":629,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115914':14A,17A '-2026':13A,16A '0.11.1':35B,95C '0.32.0':38B,97C,184C '2':105C 'ai':19B 'ai-tool':18B 'allow':112C 'alon':139C 'api':123C 'assert':63B,169C 'attack':68B 'batch':146C 'check':162C 'client':42B,115C 'compat':122C 'craft':2A 'crash':5A 'cve':12A,15A 'deepseek':51B,100C,103C 'deepseek-ocr':50B,99C,102C 'emb':155C 'embed':154C 'encod':145C,164C 'engin':8A,59B,72B,89C,174C 'everi':75B 'fatal':62B,168C 'fix':181C 'gpu':22B 'gpu-infer':21B 'hit':60B 'host':30B 'imag':4A,47B,53B,110C,128C,137C,150C 'infer':7A,23B,86C 'input':151C 'issu':179C 'languag':92C 'larg':91C 'legal':46B,127C 'let':39B 'llm':25B 'llm-serv':24B 'make':56B 'mm':163C 'model':93C 'multimod':156C 'normal':130C 'ocr':3A,52B,101C,104C,109C 'offlin':73B 'one':81B 'openai':121C 'openai-compat':120C 'output':165C 'pars':147C 'path':54B,111C 'per':143C 'per-step':142C 'pixel':131C 'propag':157C 'python':27B 'reach':118C 'remot':41B,114C 'request':82B 'return':152C 'saniti':161C 'self':29B 'self-host':28B 'send':43B 'serv':26B,58B,88C 'server':79B 'shut':65B,171C 'specif':45B 'step':144C 'submit':125C 'sum':132C 'take':70B 'tool':20B 'trigger':166C 'unlimit':108C 'unlimited-ocr':107C 'user':11A,76B,177C 'valid':149C 'valu':159C 'version':33B,183C 'vllm':1A,31B,32B,83C 'whose':129C 'zero':134C","nicknames":[],"mitigations":[],"who_affected":"Teams running vLLM between 0.11.1 and 0.32.0 that serve DeepSeek-OCR, DeepSeek-OCR-2 or Unlimited-OCR models and accept image input from clients that can reach the OpenAI-compatible API. Deployments that serve only text models or keep the API behind a private network are less exposed. Teams on 0.32.0 or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115914","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115914","severity":null,"published_at":"2026-10-26T18:17:38+00:00","modified_at":"2026-10-26T18:17:38+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","fetched_at":"2026-10-26T18:31:43+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}