Denial-of-service vulnerability in vLLM's DeepSeek-OCR image processing

The vLLM security advisory (GHSA-gq5q-89c7-vhvx, CVE-2026-115914) discloses that vLLM services deploying deepseek-ai/DeepSeek-OCR, DeepSeek-OCR-2, or baidu/Unlimited-OCR can be completely crashed under the default configuration by a single unauthenticated chat request carrying an ordinary PNG image. The root cause is a check inherited from the upstream DeepSeek-OCR reference implementation: it returns None when the sum of pixel_values is 0, and after an image is normalized with ToTensor and Normalize(0.5, 0.5), the sum for a 1024×1024 half-black half-white image is exactly 0; the return value triggers an assertion failure on the worker side, the EngineCore process dies, the API server exits, and it cannot recover on its own. Affected versions are 0.11.1 and above, before 0.32.0; it has been fixed in 0.32.0 (MR59417).