Executive brief
A vulnerability exists in llama.cpp, a popular library used for running Large Language Models (LLMs). By providing a specially crafted JSON schema, a remote attacker can cause the software to crash. This results in a denial-of-service, potentially interrupting AI services or applications relying on this library for processing data.
Technical details
A vulnerability exists in the `_visit_pattern` function within `common/json-schema-to-grammar.cpp` of llama.cpp. The issue stems from improper validation of regex patterns during JSON-Schema to grammar conversion. Specifically, the code calls `seq.back()` without verifying if the vector is empty when handling quantifiers (e.g., *, +, ?, {n,m}) following unsupported regex constructs like lookarounds. Additionally, the `transform()` function lacks a recursion depth limit, leading to potential stack exhaustion. A remote attacker can exploit this by submitting a crafted JSON schema (e.g., via a `response_format` request to a server) to trigger a SIGSEGV or stack overflow, resulting in a process crash. A pull request (#25308) has been proposed to add null checks and nesting limits.
Affected products
- ggml-org llama.cpp d006858, e15efe0
Timeline
- 2026-07-03: disclosed: Issue reported on GitHub repository
- 2026-07-04: other: Pull request #25308 submitted to fix the issue
- 2026-07-27: advisory: CVE-2026-17500 published