EUVD-2026-49061
GHSA-h334-888w-8prr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network attack, no privileges required, only availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes allocation of resources. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.
AnalysisAI
Remote denial of service in llama.cpp allows unauthenticated attackers to exhaust server resources via crafted JSON schema inputs that trigger unbounded recursion in the JSON-schema-to-GBNF conversion routine. Affected versions include commit e15efe0 and prior. A fix exists in a pending pull request; no active exploitation reported.
Technical ContextAI
llama.cpp is an open-source C++ library for LLaMA model inference that includes a JSON schema to GBNF grammar converter to steer model output. The vulnerability (CWE-770) resides in the transform function of common/json-schema-to-grammar.cpp, where recursive schema processing lacks a depth limit and certain quantifier/repetition checks on empty patterns are missing, allowing a remote attacker to force deep recursion or invalid grammar construction, leading to excessive CPU/memory consumption. Affected product CPE: cpe:2.3:a:ggml-org:llama.cpp:*:*:*:*:*:*:*:*.
RemediationAI
Apply the patch from pull request #25308 (https://github.com/ggml-org/llama.cpp/pull/25308) which introduces a maximum nesting depth and safeguards against empty pattern repetition. If the patch cannot be applied immediately, restrict access to the JSON schema conversion endpoint to trusted clients only, or implement pre-validation that rejects overly complex schemas before they reach the vulnerable function. Note: the PR has not been merged into a tagged release; rebuilding from the patched source is required.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Remote code execution in llama.cpp (ggml-org) prior to build b8585 arises from a use-after-free in the RPC server's GRAP
A buffer overflow vulnerability in llama.cpp (CVSS 8.8). High severity vulnerability requiring prompt remediation. Vendo
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today