Executive brief
llama.cpp is an open-source framework for running large language models locally. The framework contains a denial-of-service vulnerability in its JSON schema parsing logic that can crash the server when processing deeply nested schemas. An unauthenticated remote attacker can exploit this by sending a malicious request with a deeply nested JSON schema, causing the application to become unavailable.
Technical details
The vulnerability is an uncontrolled recursion flaw in common/json-schema-to-grammar.cpp, specifically in the SchemaConverter::visit and _generate_union_rule functions. The vulnerable code lacks recursion depth limits when processing JSON schemas. An attacker can trigger a stack overflow by submitting a POST request to the /completions endpoint with a json_schema field containing deeply nested structures (≥7000 levels observed). This exhausts the thread stack and crashes the server, resulting in denial of service. The /v1/chat/completions endpoint is not affected because it routes json_schema through a Jinja engine. As of the latest release (b10405 as of August 2026), the vulnerability remains unpatched with no recursion depth controls in place.
Affected products
- ggml-org llama.cpp b5693 and earlier
Timeline
- 2026-09-01: disclosed: Published on NVD
- 2026-08-12: other: Initial public disclosure on Ph4nt0m blog