CVE-2026-115914

vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalized pixels sum to zero when that image i...

CVE-2026-115914

The vLLM inference engine (versions 0.11.1 through 0.32.0) is vulnerable to a denial of service via the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image paths. A remote client capable of reaching the OpenAI-compatible API can submit a legal image with normalized pixels summing to zero. When ...