vLLM DeepSeek-OCR image processing vulnerable to denial of service

影響: pip:vllm >= 0.11.1, < 0.32.0 → 0.32.0

Any vLLM deployment serving a model of the DeepSeek-OCR family — deepseek-ai/DeepSeek-OCR, deepseek-ai/DeepSeek-OCR-2, or baidu/Unlimited-OCR (whose UnlimitedOCRForCausalLM subclasses DeepseekOCRForCausalLM) — can be killed by a single unauthenticated chat request carrying an ordinary, schema-valid PNG image, under completely default server configuration. The image model's input validation contains a guard inherited from the upstream DeepSeek-OCR reference implementation: python vllm/model_exec…

GitHub Advisory Databaseで読む

2026/10/29 06:15、GitHub Advisory Databaseが「vLLM DeepSeek-OCR image processing vulnerable to denial of service」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。CVE: CVE-2026-115914。