Executive brief
llama.cpp is a popular software library used to run Large Language Models (LLMs) on various hardware. A vulnerability was found in the component that converts JSON schemas into grammar rules, which is often used to ensure AI responses follow a specific format. An attacker could send a specially crafted, deeply nested JSON schema to a server running this software, causing the application to crash and resulting in a denial of service.
Technical details
A stack overflow (uncontrolled recursion) vulnerability exists in the `transform` function within `common/json-schema-to-grammar.cpp` of llama.cpp. The issue stems from the JSON-Schema-to-GBNF conversion process, which lacks a depth limit when recursing on nested schema constructs or parenthesized regex patterns. A remote, unauthenticated attacker can trigger this by providing a crafted `response_format` or JSON schema via the server API. This leads to stack exhaustion and a process crash (CWE-674/CWE-770). A pull request (#25308) has been proposed to enforce a `MAX_PATTERN_NESTING` limit and add validation for malformed regex quantifiers.
Affected products
- ggml-org llama.cpp e15efe0
Timeline
- 2026-07-03: disclosed: Issue reported on GitHub
- 2026-07-04: patched: Pull request submitted to fix the issue
- 2026-07-27: advisory: CVE published