llama.cpp: uncontrolled recursion in JSON-schema-to-grammar conversion crashes the server

CVE-2026-52130AI/ML frameworks & servingcurated

Impact

A crafted JSON schema drives unbounded recursion in the schema-to-grammar converter and takes the process down. That converter is the path llama.cpp uses to turn a caller-supplied JSON schema into a decoding grammar, so on a llama-server deployment the input arrives with an ordinary completion request; the record does not spell out the reachable entry point beyond naming the file. Impact is availability only - no memory corruption or data disclosure is claimed. On a GPU node this costs the loaded model's warm weights and VRAM state, and a restart on a large model is minutes of lost serving capacity, repeatable by the same caller.

Who can reach it

Anyone who can send a completion request carrying a JSON schema to a llama.cpp server. NVD scores it network-reachable and unauthenticated (AV:N/PR:N), which matches an exposed llama-server with no gateway or auth in front of it; behind an authenticating proxy the caller must be an authorized tenant.

What to do

Upgrade past build b5693 and restart the server process - the record states only that 'b5693 and before' is vulnerable and names no fixed build, so pin to a current release rather than a version invented here. No node drain or reboot is involved; each affected inference daemon restarts on its own. Until then, reject or depth-limit client-supplied JSON schemas at the gateway.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-52130 https://blog.ph4nt0m.xyz/ko/cves/cve-2026-52130/https://github.com/ggml-org/llama.cpp

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.