Database/AI/ML frameworks & serving
llama.cpp ggml RPC server: null pointer dereference in graph_compute kills the GPU worker
Impact
A crafted graph_compute request makes rpc_server dereference a null pointer and terminate the process. The supplied CVSS vector claims availability impact only (VC:N/VI:N/VA:L), so this is a denial of service rather than a data-exposure or integrity issue. On a pooled deployment each crash drops that worker's shard of the model, and because the request needs no authentication a client can loop it - the GPUs sit idle behind a supervisor that keeps restarting a process that keeps dying. Cost is wasted accelerator time and failed inference requests, not a node drain.
Who can reach it
Network, unauthenticated. Any client able to reach the ggml rpc-server port; the server does not authenticate its callers.
What to do
No fixed release exists - the upstream pull request (#25670) is open and awaiting acceptance. Restrict the rpc-server port so only the coordinating process can reach it, keep the worker under a supervisor so a crash restarts cleanly, and track PR #25670 for the fix. Once it merges, adopting it is a binary update and a worker restart, not a node reboot.
References
Related entries
- BentoML: SSRF filter misses 100.64.0.0/10, so serving pods fetch from internal CGNAT hostsCVE-2026-78205 · BentoML make_safe_connect (SSRF address filter, RFC 6598 range)Medium
- ONNX: symlink-following external-data write lets a local attacker append to victim-writable filesCVE-2026-49114 · ONNX Python library (save_external_data external-data path handling)Medium
- Hugging Face Transformers: checkpoint index shard names traverse out of the model directoryCVE-2026-75104 · Hugging Face Transformers (checkpoint shard index filename handling)Medium
- Ollama: DNS rebinding grants a remote page full API accessCVE-2024-28224 · OllamaMedium
- Dagster (gRPC `get_notebook_data`): Local file inclusion — read arbitrary filesCVE-2025-51481 · Dagster (gRPC `get_notebook_data`)Medium
- llama.cpp (GGUF vocabulary parsing, llama_vocab::impl::print_info): MALICIOUS MODEL FILE CRASHES THE SERVER: the GGUFNCVD-2025-020-llama-cpp-gguf-vocabulary-parsin · llama.cpp (GGUF vocabulary parsing, llama_vocab::impl::print_info)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.