LLMMedium

CVE-2026-115914: vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the Dee…

Occurred: Oct 26, 2026
Published: Oct 26, 2026
Source: NVD CVE

Summary

vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalized pixels sum to zero when that image is alone in its per-step encoder batch. _parse_and_validate_image_input returns no embedding, embed_multimodal propagates that value, and sanity_check_mm_encoder_outputs triggers a fatal assertion that shuts down the engine for all users. This issue is fixed in version 0.32.0.

Classification

Category confidence: 90%

Severity confidence: 85%

Rationale: CVE describes a denial-of-service vulnerability in vLLM inference engine triggered by specific image inputs causing fatal assertion.

Classifier: Qwen/Qwen3.5-35B-A3B-FP8

Visit source

Summary

Tags

Classification