Which versions of llama.cpp are affected by CVE-2026-43628?

The llama.cpp inference server (builds b3978-b9058) is vulnerable to complete, instantaneous service failure for all connected users via a single unauthenticated remote HTTP request, with no vendor…

How to fix or mitigate CVE-2026-43628?

Within 24 hours: isolate all llama.cpp instances from untrusted networks, or implement HTTP request validation to reject `dry_allowed_length` parameter values at or near INT32_MIN (-2147483648). Within 7 days: conduct a full inventory of llama.cpp deployments on affected builds (b3978-b9058), implement network segmentation restricting the HTTP API to authenticated internal users only, and deploy monitoring to detect failed inference requests or service crashes that may indicate exploitation attempts. Within 30 days: check for patches in llama.cpp releases beyond b9058, deploy Web Application Firewall (WAF) rules to filter extreme integer parameter values, and conduct an architectural review of inference API exposure to untrusted networks.

llama.cpp CVE-2026-43628

Q: What is the CVSS score of CVE-2026-43628?

CVE-2026-43628 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-54283 HIGH

Out-of-bounds Read (CWE-125)

2026-08-06 disclosure@vulncheck.com

GHSA-wvf4-v63v-mwm5

Buffer Overflow Denial Of Service Information Disclosure

8.5

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

HTTP endpoint attack is network-exploitable with no credentials or user interaction; SIGSEGV yields high availability impact, while OOB memory read and sampling corruption yield limited confidentiality and integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 23:04 vuln.today

CVE Published

Aug 06, 2026 - 22:17 cve.org

HIGH 8.5

DescriptionCVE.org

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the /v1/completions or /v1/chat/completions endpoints. Attackers can exploit this vulnerability to crash the server with SIGSEGV causing denial of service for all connected users, or corrupt token sampling probabilities by reading garbage values from memory before the allocated buffer.

AnalysisAI

Integer underflow and heap out-of-bounds read in llama.cpp's DRY sampler (builds b3978 through b9058) allows remote unauthenticated attackers to crash the inference server or corrupt token sampling probabilities by sending a single crafted HTTP request. Setting the dry_allowed_length parameter to INT32_MIN triggers arithmetic wrap-around in the sampler, causing it to read memory before the allocated heap buffer and producing a SIGSEGV that terminates service for all connected users. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the trivially reproducible single-parameter trigger makes this a high-priority issue for any deployment exposing the llama.cpp HTTP API on a network.

Technical ContextAI

llama.cpp is a C/C++ inference runtime for running large language models locally, exposing an OpenAI-compatible HTTP API at /v1/completions and /v1/chat/completions. The DRY (Don't Repeat Yourself) sampler is a repetition-penalty mechanism introduced around build b3978 that operates on a sliding window of sampled token history. CWE-125 (Out-of-Bounds Read) manifests here via integer underflow: when the caller-controlled dry_allowed_length field is set to INT32_MIN (-2147483648), subsequent signed arithmetic on that value wraps or underflows, yielding an address offset that precedes the start of the sampler's heap-allocated buffer. The CPU then reads arbitrary process memory at that location - either crashing immediately with SIGSEGV or silently feeding garbage values into the token probability distribution, corrupting model output. The flaw spans hundreds of consecutive builds (b3978-b9058), indicating the DRY feature shipped without bounds validation on this parameter throughout its entire existence in the codebase.

RemediationAI

No vendor-confirmed patched build version is identified in the available data - the sole reference (https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches) is a third-party community repository, and a released patched version has not been independently confirmed; treat any fix version from that source as unverified until corroborated by the official llama.cpp maintainers. Until an authoritative patch is confirmed and deployed, apply the following compensating controls: restrict network access to the llama.cpp HTTP server via firewall rules or a reverse proxy with IP allowlisting, accepting reduced accessibility as a trade-off; add input validation at the reverse proxy or application layer to reject dry_allowed_length values below zero or above a defined maximum before the parameter reaches the sampler; run the llama.cpp process under a supervisor (e.g., systemd with Restart=always) to automatically recover from SIGSEGV crashes, limiting the window of DoS to seconds rather than indefinite downtime; and avoid exposing the API on public or untrusted networks until a verified patch is applied. Monitor server crash logs for repeated SIGSEGV signals as an indicator of active exploitation attempts.