llama.cpp llama-server: crafted sampler parameter triggers out-of-bounds read and unauthenticated crash

Impact

Anyone who can send an HTTP request to llama-server can set dry_allowed_length to INT32_MIN and drive an integer underflow in the DRY sampler, reading before the allocated buffer. The record describes two outcomes: a SIGSEGV that kills the server process and drops every in-flight session on that replica, and silent corruption of token sampling probabilities from the garbage read. On a GPU node that means the whole inference worker dies and its model weights have to be reloaded into VRAM before it serves again, so a single request costs minutes of capacity, not milliseconds. The corrupted-sampling case is worse to detect: the endpoint keeps answering, but output quality on the affected replica degrades with nothing in the logs. llama-server is frequently run with no authentication behind a gateway, so exposure comes down to who can reach the port.

Who can reach it

Anyone who can reach the llama-server HTTP port. The description states the request is unauthenticated; llama-server has no built-in tenant separation, so any tenant, sidecar, or internal service allowed to hit the completions endpoint qualifies.

What to do

The record names affected builds b3978 through b9058 but does not name a fixed build - check the upstream advisory before scheduling, and do not assume the b7446 release referenced by the other llama.cpp issues covers this one. Until a build lands, reject or clamp client-supplied dry_allowed_length at the API gateway and keep the raw llama-server port off any tenant-reachable network. Rolling a new build is a per-replica daemon restart: pull the replica from the load balancer, restart, wait for the model to reload into VRAM. No node drain or reboot.

References

Related entries

• NVIDIA OpenShell Sandbox: path traversal bypasses L7 REST network policy, exposing blocked endpointsCVE-2026-65092 · NVIDIA OpenShell Sandbox for Linux (L7 REST network policy enforcement)High
• Darknet: integer overflow in convolutional layer sizing yields a heap overflow from a crafted .cfgCVE-2026-72852 · hank-ai/darknet convolutional layer (.cfg model definition parsing)High
• skops (`Card.get_model`): Model card loading has no trusted-types checkCVE-2025-54886 · skops (`Card.get_model`)High
• mcp-shell: allowlist validates only the first token, so /bin/bash -c runs any commandCVE-2026-55581 · mcp-shell (security.go command allowlist, /bin/bash -c handling)High
• mcp-shell: allowed git binary runs arbitrary commands via a `!` alias, bypassing secure modeCVE-2026-55582 · mcp-shell (security.go shell-metacharacter checks, git alias handling)High
• Gradio: CORS origin validation bypassCVE-2024-47084 · GradioHigh