Database/AI/ML frameworks & serving
llama.cpp RPC server: crafted tensor dimensions hit a reachable assertion and abort the process
Impact
The RPC backend is what splits a llama.cpp model across several GPU hosts, so the rpc-server process holds a share of the model and the GPUs behind it. A manipulated ne argument in a deserialized tensor reaches an assertion and terminates the server. The record scores it availability-only (VA:L, no confidentiality or integrity impact) and requires no authentication. On a multi-host inference deployment one killed backend stalls the whole pipeline and leaves the attached GPUs idle until something restarts it, and the request can be repeated as fast as it is served.
Who can reach it
Anyone with network reach to the rpc-server listening port. The record describes the attack as remote with no privileges and no user interaction required.
What to do
No fixed version is identified in the record - the upstream GitHub issue was closed automatically for inactivity. Treat this as mitigate-only: bind rpc-server to loopback or a dedicated backend network reachable only by the coordinating llama.cpp process, never from tenant or user-facing networks, and supervise the process so a crash restarts it. Recovery from an individual crash is a process restart, not a node action.
References
Related entries
- ONNX: symlink-following external-data write lets a local attacker append to victim-writable filesCVE-2026-49114 · ONNX Python library (save_external_data external-data path handling)Medium
- NVIDIA OpenShell: sandbox exec handler is vulnerable to OS command injection, breaking the sandbox boundaryCVE-2026-65086 · NVIDIA OpenShell for Linux (sandbox exec handler)Medium
- Hugging Face Transformers: checkpoint index shard names traverse out of the model directoryCVE-2026-75104 · Hugging Face Transformers (checkpoint shard index filename handling)Medium
- Ollama: DNS rebinding grants a remote page full API accessCVE-2024-28224 · OllamaMedium
- Dagster (gRPC `get_notebook_data`): Local file inclusion — read arbitrary filesCVE-2025-51481 · Dagster (gRPC `get_notebook_data`)Medium
- llama.cpp (GGUF vocabulary parsing, llama_vocab::impl::print_info): MALICIOUS MODEL FILE CRASHES THE SERVER: the GGUFNCVD-2025-020-llama-cpp-gguf-vocabulary-parsin · llama.cpp (GGUF vocabulary parsing, llama_vocab::impl::print_info)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.