Database/AI/ML frameworks & serving
llama.cpp RPC server: crafted tensor dimensions hit a reachable assertion and abort the process
Impact
The RPC backend is what splits a llama.cpp model across several GPU hosts, so the rpc-server process holds a share of the model and the GPUs behind it. A manipulated ne argument in a deserialized tensor reaches an assertion and terminates the server. The record scores it availability-only (VA:L, no confidentiality or integrity impact) and requires no authentication. On a multi-host inference deployment one killed backend stalls the whole pipeline and leaves the attached GPUs idle until something restarts it, and the request can be repeated as fast as it is served.
Who can reach it
Anyone with network reach to the rpc-server listening port. The record describes the attack as remote with no privileges and no user interaction required.
What to do
No fixed version is identified in the record - the upstream GitHub issue was closed automatically for inactivity. Treat this as mitigate-only: bind rpc-server to loopback or a dedicated backend network reachable only by the coordinating llama.cpp process, never from tenant or user-facing networks, and supervise the process so a crash restarts it. Recovery from an individual crash is a process restart, not a node action.
References
Related entries
- vLLM: audio extracted from video input ignores decode size and duration limitsCVE-2026-90554 · vLLM (NanoNemotronVL audio-from-video extraction, _extract_audio_from_videos)Medium
- vLLM: unvalidated MoRIIO ack fields let a remote client exhaust resources on a serving nodeCVE-2026-92220 · vLLM MoRIIO KV-transfer connector (acknowledgement handler)Medium
- vLLM: rejected prefill requests leak Mooncake transfer placeholders, stalling valid requestsCVE-2026-94625 · vLLM MooncakeConnector (KV transfer placeholder reclamation)Medium
- llama.cpp: heap out-of-bounds read in vocab print_info crashes model loading on a crafted GGUF tokenizerCVE-2025-71439 · llama.cpp llama_vocab::impl::print_info() (tokenizer.ggml.tokens bounds)Medium
- JupyterLab: language-pack Plural-Forms header reaches new Function, executing code in the session originCVE-2026-102830 · JupyterLab / JupyterLite (translation catalogue Plural-Forms parser)Medium
- ONNX: symlink-following external-data write lets a local attacker append to victim-writable filesCVE-2026-49114 · ONNX Python library (save_external_data external-data path handling)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.