UpHeron
All vulnerabilities

Servers and applications

CVE-2026-115914

DeepSeek-OCR family: an image whose normalized pixels sum to exactly 0 makes embed_multimodal return None, tripping the encoder-output sanity assert — one unauthenticated request kills the whole vLLM engine (default config)

Severity
Medium 6.5
Published
20 Oct 2026
Last changed
30 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
0.32.0
Also known as
GHSA-gq5q-89c7-vhvx
Sources
NVD, CVE Program, Project advisories (GitHub)

Description

vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalized pixels sum to zero when that image is alone in its per-step encoder batch. _parse_and_validate_image_input returns no embedding,…

Affected software

SoftwareAffected versions
vLLMServers and applications · cna:vllm-project|vllm
  • From 0.11.1 before 0.32.0
vLLMServers and applications · cpe:a:vllm:vllm
  • From 0.11.1 before 0.32.0
vLLMServers and applications · github:vllm-project/vllm
  • Version 0.30.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-115914
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-115914
  • GitHub Advisory Database https://github.com/advisories/GHSA-gq5q-89c7-vhvx
  • github.com https://github.com/vllm-project/vllm/security/advisories/GHSA-gq5q-89c7-vhvx