CVE-2026-115914

Name of the Vulnerable Software and Affected Versions vLLM versions 0.11.1 through 0.31.0

Description A remote client accessing the OpenAI-compatible API can cause a denial of service by submitting a specific legal image where normalized pixels sum to zero when processed alone in a per-step encoder batch. This sequence leads the parse and validate image input function to return no embedding, which is then propagated by embed multimodal. Consequently, the sanity check mm encoder outputs function triggers a fatal assertion, shutting down the engine for all users. This affects the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image paths.

Recommendations Update vLLM to version 0.32.0.