AI Threat AlertCVE-2026-115914 lets any authenticated client of a vLLM OpenAI-compatible API crash the entire inference engine by submitting a legal image whose normalized pixels sum to zero, which triggers a fatal assertion when the DeepSeek-OCR, DeepSeek-OCR-2 or Unlimited-OCR image path is in use. The impact is availability only (CVSS 6.5, no confidentiality or integrity loss), but one request takes the engine down for every tenant sharing it. Exploitation is low-complexity and needs only low privileges. There is no public exploit, no Nuclei template, no KEV listing and no EPSS score yet, so this is not currently a breaking-alert item. vLLM has 94 tracked downstream dependents and 176 other CVEs, so exposure is broad even though only deployments serving the affected OCR models are vulnerable. Upgrade to vLLM 0.32.0 or later (versions 0.11.1 up to 0.32.0 are affected). If you can't upgrade, restrict API access to trusted clients and make sure the engine restarts automatically.
What is the risk?
Medium. Network-reachable, low complexity, low privileges, no user interaction, with a high availability impact (CVSS 6.5). It only applies to deployments serving DeepSeek-OCR, DeepSeek-OCR-2 or Unlimited-OCR models on vLLM 0.11.1 through 0.31.x. The trigger is a valid but unusual image, so input validation and generic WAF rules are unlikely to catch it. Risk rises for multi-tenant or internet-exposed endpoints and for services with no automatic restart. No public exploit or active exploitation is known, and EPSS data is unavailable.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| vLLM | pip | >= 0.11.1, < 0.32.0 | 0.32.0 |
Do you use vLLM? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade vLLM to 0.32.0 or later (fix in PR 59417, commit c15672cf). 2) If you can't patch immediately, stop serving the DeepSeek-OCR, DeepSeek-OCR-2 and Unlimited-OCR models or restrict the OpenAI-compatible API to trusted clients behind authentication, network segmentation and per-client rate limits. 3) Run vLLM under a supervisor (systemd, Kubernetes) with automatic restart and health checks to reduce downtime. 4) Isolate OCR serving from other models and tenants so one crash doesn't affect them. 5) Detect: alert on unexpected engine exits, assertion failures from sanity_check_mm_encoder_outputs in logs, and repeated restarts correlated with image uploads from a single client.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-115914?
CVE-2026-115914 lets any authenticated client of a vLLM OpenAI-compatible API crash the entire inference engine by submitting a legal image whose normalized pixels sum to zero, which triggers a fatal assertion when the DeepSeek-OCR, DeepSeek-OCR-2 or Unlimited-OCR image path is in use. The impact is availability only (CVSS 6.5, no confidentiality or integrity loss), but one request takes the engine down for every tenant sharing it. Exploitation is low-complexity and needs only low privileges. There is no public exploit, no Nuclei template, no KEV listing and no EPSS score yet, so this is not currently a breaking-alert item. vLLM has 94 tracked downstream dependents and 176 other CVEs, so exposure is broad even though only deployments serving the affected OCR models are vulnerable. Upgrade to vLLM 0.32.0 or later (versions 0.11.1 up to 0.32.0 are affected). If you can't upgrade, restrict API access to trusted clients and make sure the engine restarts automatically.
Is CVE-2026-115914 actively exploited?
No confirmed active exploitation of CVE-2026-115914 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-115914?
1) Upgrade vLLM to 0.32.0 or later (fix in PR 59417, commit c15672cf). 2) If you can't patch immediately, stop serving the DeepSeek-OCR, DeepSeek-OCR-2 and Unlimited-OCR models or restrict the OpenAI-compatible API to trusted clients behind authentication, network segmentation and per-client rate limits. 3) Run vLLM under a supervisor (systemd, Kubernetes) with automatic restart and health checks to reduce downtime. 4) Isolate OCR serving from other models and tenants so one crash doesn't affect them. 5) Detect: alert on unexpected engine exits, assertion failures from sanity_check_mm_encoder_outputs in logs, and repeated restarts correlated with image uploads from a single client.
What systems are affected by CVE-2026-115914?
This vulnerability affects the following AI/ML architecture patterns: model serving, multimodal inference, OCR and document-processing pipelines, OpenAI-compatible API gateways.
What is the CVSS score for CVE-2026-115914?
CVE-2026-115914 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.40%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0029Denial of AI ServiceAML.T0040AI Model Inference API AccessAML.T0043Craft Adversarial DataCompliance Controls Affected
What are the technical details?
Original Advisory
vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalized pixels sum to zero when that image is alone in its per-step encoder batch. _parse_and_validate_image_input returns no embedding, embed_multimodal propagates that value, and sanity_check_mm_encoder_outputs triggers a fatal assertion that shuts down the engine for all users. This issue is fixed in version 0.32.0.
Exploitation Scenario
An attacker with low-privilege credentials, such as a trial account or a leaked API key, to an exposed vLLM endpoint serving DeepSeek-OCR submits a valid image whose normalized pixel values sum to zero, for example a specifically crafted image. When it is the only image in its encoder batch, the image parser returns no embedding, the assertion fails and the engine terminates. The attacker repeats the request after every restart to keep the document-processing service offline for all tenants.
Weaknesses (CWE)
CWE-617 — Reachable Assertion: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
- [Implementation] Make sensitive open/close operation non reachable by directly user-controlled data (e.g. open/close resources)
- [Implementation] Perform input validation on user data.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HReferences
- github.com/vllm-project/vllm/commit/c15672cfb49152ebf65cfd188e71b84593ec5686x_refsource_MISC
- github.com/vllm-project/vllm/pull/59417x_refsource_MISC
- github.com/vllm-project/vllm/releases/tag/v0.32.0x_refsource_MISC
- github.com/vllm-project/vllm/security/advisories/GHSA-gq5q-89c7-vhvxx_refsource_CONFIRM
- github.com/advisories/GHSA-gq5q-89c7-vhvx
- nvd.nist.gov/vuln/detail/CVE-2026-115914
Timeline
Related Vulnerabilities
CVE-2026-6173210.0Decepticon: ChatML token injection yields sandbox RCE
Same package: vllmCVE-2024-110419.8vllm: RCE via unsafe pickle deserialization in MessageQueue
Same package: vllmCVE-2025-472779.8vLLM: RCE via exposed TCPStore in distributed inference
Same package: vllmCVE-2026-259609.8vllm: SSRF allows internal network access
Same package: vllmCVE-2024-90539.8vllm: RCE via unsafe pickle deserialization in RPC server
Same package: vllm