Database/AI/ML frameworks & serving
llama.cpp server: negative top_n on /rerank drives an unbounded allocation and denial of service
Impact
When the server is started with --reranking, a POST to /rerank carrying a negative top_n reaches an allocation sized from that value, producing std::bad_alloc and an HTTP 500. The immediate effect is a failed request, but the allocation attempt is the damaging part: a reranking server sitting behind a retrieval pipeline can be pushed into large host-memory demand by repeated cheap requests, and on a GPU node that shares host RAM across several serving containers the pressure is felt by neighbours, not just the sender. The record describes denial of service only - no code execution, no disclosure. Only deployments that actually enable --reranking are exposed.
Who can reach it
Anyone who can send an HTTP POST to /rerank on a server started with --reranking. The record indicates no authentication is required, so exposure follows whatever network reaches that port - any tenant pod on the cluster network if the endpoint is not fronted by an authenticating gateway.
What to do
The record names llama.cpp through commit 97f06e9 and states no fixed build - read the upstream repository for the commit that clamps top_n before planning an upgrade rather than assuming a version. In the meantime, reject non-positive top_n at the gateway or proxy in front of the server, keep /rerank off tenant-reachable networks, and drop --reranking where reranking is not actually used. Every one of these changes is a restart of the inference server process; GPU nodes stay up.
References
Related entries
- Hugging Face Transformers: load_custom_generate writes remote code to disk before the trust checkCVE-2026-80047 · Hugging Face Transformers (dynamic_module_utils.py, load_custom_generate remote-code cache)Unscored
- Jupyter Notebook (untrusted notebooks): Untrusted notebook executes JavaScript in the user's session on openCVE-2021-32798 · Jupyter Notebook (untrusted notebooks)Critical
- MLflow: Absolute path traversal prior to 2.5.0CVE-2023-3765 · MLflowCritical
- TorchServe: Unauthenticated SSRFCVE-2023-43654 · TorchServeCritical
- BentoML: Insecure deserializationCVE-2024-2912 · BentoMLCritical
- llama.cpp (RPC backend): Unsafe `data` pointer in `rpc_tensor`CVE-2024-42479 · llama.cpp (RPC backend)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.