Vulnerabilities

Vulnerability · CVE-2026-115914

vLLM DeepSeek-OCR image processing vulnerable to denial of service

Published Oct 26, 2026 · catalog updated Oct 28, 2026 · Red Hat Red Hat Enterprise Linux

Last checked Nov 4, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115914. EPSS is 0.40%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Severity

Medium6.5

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.40%

Remediation

Version ranges on file

Affected products

pip vllm · pypi vllm

## Summary Any vLLM deployment serving a model of the DeepSeek-OCR family — , , or (whose subclasses ) — can be **killed by a single unauthenticated chat request carrying an ordinary, schema-valid PNG image**, under completely default server configuration. The image model's input validation contains a guard inherited from the upstream DeepSeek-OCR reference implementation: In the original research code this was an empty-batch shortcut; in vLLM's serving architecture is the actual client image tensor, and the condition is **exactly satisfiable by a legitimate image**: the in-tree normalizes pixels with ( ), mapping pixel value 0 → exactly −1.0 and 255 → exactly +1.0 in float32. A 1024×1024 image that is half pure black and half pure white (a perfectly ordinary 1-bit-style scanned-document PNG for an OCR model) therefore yields **exactly** (equal counts of ±1.0; pairwise reduction stays integer-exact, well inside float32's 2²⁴ exactness bound). is the identity map for an already-1024×1024 image ( ), so no padding pixels disturb the balance. Returning makes return ( ), which immediately trips the engine-side sanity check in the worker: The is raised inside the encoder runner of the EngineCore worker process with no per-request containment, escapes to the busy loop's top-level handler ( , "EngineCore encountered a fatal error."), triggers at the API server ( ), and the whole process tree shuts down permanently. refuses connections until a manual restart. Verified end-to-end on the official image (id d076d77d8dad) with real weights: after confirming 200, a text chat 200, and two control images (all-white and all-black 1024×1024) 200, the single half-black/half-white request returned HTTP 500 ( ), the engine log shows at , the API server shut itself down, and the container exited ( , ). Every subsequent request, including , fails at the socket. The vulnerable check is unchanged on (verified 2026-09-30 against the raw file on the default branch). **Environment notes (discl