Three vLLM breaking issues expose default-server attack paths

DeepSeek-OCR family: an image whose normalized pixels sum to exactly 0 makes embed_multimodal return None, tripping the encoder-output sanity assert — one unauthenticated request kills the whole vLLM vllm-project/vllm

An image whose normalized pixels sum to exactly 0 makes embed_multimodal return None, which trips the encoder-output sanity assert and takes down the entire engine, not one request. It needs no authentication and reproduces on the default config, so the mitigation is network-level until a fix lands.

Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled vllm-project/vllm

Forging a public multimodal SHM handle gets attacker-controlled bytes to worker-side pickle.loads() even with insecure serialization turned off, so that setting is not the boundary operators assume it is. Treat any unauthenticated endpoint that accepts multimodal input as code execution.

Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server vllm-project/vllm

The HTTP server's default CORS origins are permissive, so any page a browser on the host or a reachable network opens can issue cross-origin requests to it. Pin the allowed origins explicitly wherever the server is not strictly loopback-only.

v0.5.22 sgl-project/sglang

by ch-wan

SGLang's v0.5.22 collects 950 PRs from 245 contributors, with new Clef, Clef Flash and PPLX-Decider model entries in the cookbook. The same release removes the tokenspeed_mla backend and its hard dependency, which the motivation says cutedsl_mla already covers as the default MLA decode backend on Blackwell (FP8 or BF16 KV, page size 32/64), so MLA deploys on that path change shape.

[Metal] Add staged affine_qmm_t_nax kernels with split-k ml-explore/mlx

by wyanzhao

Split-K NAX kernels and a 16-row simdgroup schedule give transposed affine quantized_matmul a fast route on M5: a 85-token forward pass for LiquidAI d1-3B with locally converted 4-bit weights drops from 30.1 ms on main to 14.5 ms.

server: cancel remote inference when clients disconnect ollama/ollama

by hoyyeva

Cancelling a local request against a configured remote model used to leave the upstream chat or generate call running. The server now passes the request context to both API client calls, so the cancellation reaches the upstream HTTP request instead of billing and occupying it.

anthropic: surface errors after streaming starts ollama/ollama

by hoyyeva

Streaming /v1/messages responses dropped in-band runner failures after HTTP 200, leaving clients with partial text and no stated cause. Ollama now detects those errors before chat-response conversion and flushes an Anthropic error event in both the ordinary and web-search passthrough writers.

server : forward llama.cpp sampling params on /v1/messages (#30856) ggml-org/llama.cpp

by David Garcia

The /v1/messages endpoint now forwards llama.cpp sampling parameters instead of copying only a listed set of keys, passing the request through. Alongside: hexagon FLASH_ATTN_EXT tuning for longer context and SWA models and a cooperative-k dp4a GEMM for q4_0, q4_k and q6_k in llama.cpp, and big-endian conversion tests against stories15M to catch byteswap regressions the release notes say "we use...