vLLM CVE-2026-115914

The deployment must be serving a DeepSeek-OCR-family model (deepseek-ai/DeepSeek-OCR, deepseek-ai/DeepSeek-OCR-2, or baidu/Unlimited-OCR via UnlimitedOCRForCausalLM) on vLLM 0.11.1 through before 0.32.0, with the OpenAI-compatible API reachable by the client. The attacker submits a schema-valid image whose normalized pixels sum to exactly 0.0 - e.g. a 1024×1024 half-black/half-white PNG that yields equal counts of -1.0 and +1.0 after Normalize(0.5,0.5), well under the default VLLM_MAX_IMAGE_PIXELS cap. No special server flags, malformed input, or resource exhaustion are needed; it works on default configuration (cudagraph_mm_encoder=False, fault tolerance off). The single limiting factor is that the trigger image must be alone in its per-step encoder batch, which holds on an idle instance and is otherwise achieved by retrying. Scope is limited strictly to deployments serving these OCR models; instances not running them are unaffected. Note the advisory describes default-config unauthenticated reach, which conflicts with the NVD vector's PR:L.

This is a deterministic, single-request denial-of-service (CWE-617 reachable assertion) against vLLM instances serving the DeepSeek-OCR model family. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5) agrees on network reach, low complexity and high-availability-only impact, but its PR:L (authenticated) directly CONFLICTS with the GHSA advisory, which states repeatedly that a single UNAUTHENTICATED request against a DEFAULT configuration kills the engine - this discrepancy should be resolved with the vendor, and the realistic exposure is closer to PR:N. No EPSS score and no KEV status were provided in the input, so there is no signal of active or widespread exploitation; status is 'no public exploit identified' in the strict sense, though a highly detailed public PoC reference (exact trigger image, end-to-end reproduction on vllm/vllm-openai:v0.30.0) exists in the advisory and lowers the bar to weaponize considerably. No SSVC decision record was supplied; the only priority signal is the vuln.today 'this_month' label, consistent with a serious-but-not-emergency DoS that has no confirmed in-the-wild use. Net: this is a genuine, trivially reproducible availability risk for the specific deployments that serve these OCR models (impact is total service outage requiring manual restart), but it is not a confidentiality/integrity issue and shows no evidence of mass exploitation - prioritize patching for affected OCR deployments within the vendor's and advisory's timeframe rather than as a drop-everything emergency.

An attacker who can reach the OpenAI-compatible chat API of a vLLM server running DeepSeek-OCR, DeepSeek-OCR-2, or Unlimited-OCR sends one schema-valid request containing an ordinary 1024×1024 PNG that is half pure black and half pure white. After ToTensor+Normalize(0.5,0.5) the pixels sum to exactly zero, so _parse_and_validate_image_input returns None, embed_multimodal propagates it, and sanity_check_mm_encoder_outputs fires a fatal AssertionError that kills EngineCore and the API server for all users. The attack is ~0.1s, needs no special flags, costs one request, and a detailed reproduction PoC is published in the GHSA advisory; given AV:N/AC:L the only practical caveat is that the trigger image be alone in its encoder batch, which is trivially true on an idle instance and otherwise simply retried.