Database/AI/ML frameworks & serving
llama.cpp rpc-server: unauthenticated stack overflow in the ggml-rpc RDMA receive path
Impact
A peer that advertises RDMA capability in the HELLO message can push up to 256 KiB into a one-byte stack variable in rpc_serve_client(), overflowing the rpc-server stack. The record describes a crash with potential code execution. ggml-rpc is how llama.cpp shards a model across machines, so rpc-server listens on the fabric with no authentication of its own and its exposure scales with how many GPU nodes participate in a distributed inference job. Code execution in rpc-server lands in a process that holds GPU contexts and the model weights for that shard; a crash alone takes down every inference request spread across that worker. The RDMA transport makes this reachable over the same RoCE/InfiniBand fabric that crosses tenants in many clusters.
Who can reach it
Anyone able to open a ggml-rpc connection to the rpc-server port, including over the RDMA fabric. No authentication is required - ggml-rpc has none.
What to do
Upgrade to llama.cpp b11865 or later and restart every rpc-server process; affected builds are b8841 through b11864. Where upgrading has to wait, stop exposing rpc-server beyond a trusted network segment - it is designed for a closed network and should never be reachable from tenant pods. Restarting rpc-server kills in-flight distributed inference but needs no node reboot.
References
Related entries
- Crawl4AI: file:// URLs accepted by four endpoints let an unauthenticated caller read any file on the hostCVE-2026-26217 · Crawl4AI Docker API (file:// URL handling in /execute_js, /screenshot, /pdf, /html)Critical
- llama.cpp: use-after-free in the RPC server GRAPH_RECOMPUTE handler gives unauthenticated RCECVE-2026-39909 · llama.cpp RPC server (GRAPH_RECOMPUTE handler)Critical
- llama.cpp llama-server: use-after-free on the vocab pointer during idle sleep gives unauthenticated RCECVE-2026-43631 · llama.cpp llama-server (--sleep-idle-seconds idle transition)Critical
- Crawl4AI: unvalidated webhook URLs let callers make the server request internal addressesCVE-2026-56261 · Crawl4AI Docker API server (/crawl/job and /llm/job webhook URLs)Critical
- gitlab-mcp: path traversal in job_id redirects API calls to arbitrary GitLab endpointsCVE-2026-61462 · zereight gitlab-mcp (MCP server, job_id parameter in build/index.js)Critical
- Ray (`/log_proxy`): SSRF from the dashboardCVE-2023-48023 · Ray (`/log_proxy`)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.