EUVD-2026-49061
GHSA-h334-888w-8prr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted JSON schema request
-
ExploitExploit missing recursion limit in transform function
-
ExecutionExhaust server resources
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target application must invoke the |
| Impact | CVSS 4.0 rates the impact as low availability with no confidentiality or integrity loss, yet the attack vector is network and requires no authentication (AV:N/PR:N), making it trivially reachable in exposed services. EPSS data is missing, so exploitation probability cannot be quantified. No KEV listing and no public POC identified at time of analysis. The SSVC decision would treat this as a medium priority: exploitation is automatable but technical impact is partial and limited to denial of service. The risk is moderate, elevated primarily if the vulnerable endpoint is exposed to untrusted input. Missing EPSS score prevents full comparison to similar CVEs. |
| Exploit ScenarioDerived | A remote attacker sends a specially crafted JSON schema containing deeply nested patterns or empty quantifier groups to a service that uses llama.cpp’s schema-guided generation. The |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Remote denial of service in llama.cpp allows unauthenticated attackers to exhaust server resources via crafted JSON schema inputs that trigger unbounded recursion in the JSON-schema-to-GBNF conversion routine. Affected versions include commit e15efe0 and prior. A fix exists in a pending pull request; no active exploitation reported.
RemediationAI
Apply the patch from pull request #25308 (https://github.com/ggml-org/llama.cpp/pull/25308) which introduces a maximum nesting depth and safeguards against empty pattern repetition. If the patch cannot be applied immediately, restrict access to the JSON schema conversion endpoint to trusted clients only, or implement pre-validation that rejects overly complex schemas before they reach the vulnerable function. Note: the PR has not been merged into a tagged release; rebuilding from the patched source is required.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
llama.cpp is an open-source C++ library for LLaMA model inference that includes a JSON schema to GBNF grammar converter to steer model output. The vulnerability (CWE-770) resides in the transform function of common/json-schema-to-grammar.cpp, where recursive schema processing lacks a depth limit and certain quantifier/repetition checks on empty patterns are missing, allowing a remote attacker to force deep recursion or invalid grammar construction, leading to excessive CPU/memory consumption. Affected product CPE: cpe:2.3:a:ggml-org:llama.cpp:*:*:*:*:*:*:*:*.
Know when Llama Cpp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network attack, no privileges required, only availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes allocation of resources. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in llama.cpp Null Pointer and Resource Exhaustion
View all 2Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who
Stack-based out-of-bounds write in llama.cpp's ggml-rpc RDMA receive path (builds b8841 through b11865) lets unauthentic
Exploit-DB