# CVE-2026-52131: llama.cpp uncontrolled recursion denial of service in json-schema-to-grammar

Source: https://junglewise.ai/threats/cve-2026-52131-llama-cpp-uncontrolled-recursion-denial-of-service-in-json-schema  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-52131 · Severity: high · CVSS 7.5 · Published 2026-09-01

llama.cpp is an inference engine for large language models used in AI applications. A flaw in its JSON schema grammar conversion allows attackers to crash the server by submitting deeply nested JSON schema payloads, causing service disruption. The vulnerability affects only the /completions API endpoint and requires no authentication.

Technologies: [GGML Llama.Cpp](https://junglewise.ai/threats/technologies/llama-cpp). Vendors: [GGML](https://junglewise.ai/threats/vendors/ggml).

## Quick answers

**Is CVE-2026-52131 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52131 being exploited in the wild.

**How severe is CVE-2026-52131?** High severity, with a CVSS score of 7.5, published 1 September 2026.

**Which products and versions are affected?** ggml-org llama.cpp b5693 and before.

**Is there a fix for CVE-2026-52131?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-52131 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-52131?** Check whether you run GGML Llama.Cpp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an uncontrolled recursion (CWE-674) in the SchemaConverter::visit and _generate_union_rule functions within common/json-schema-to-grammar.cpp. When processing deeply nested JSON schemas (recursion depth ≥ 7000) submitted via the POST /completions endpoint's json_schema field, the recursion exhausts the thread stack and crashes the server. No recursion depth limits are enforced in the vulnerable functions. The vulnerability is network-reachable without authentication, and proof-of-concept reproduction is confirmed at depths ≥7000 on x86-64 Linux with default 8 MB thread stacks. As of the latest release (b10405 / 2026-08-13), the vulnerability remains unpatched.

## Affected products

- ggml-org llama.cpp b5693 and before

## Timeline

- 2026-08-12: disclosed
- 2026-09-01: advisory

## References

- [https://blog.ph4nt0m.xyz/ko/cves/cve-2026-52130/](https://blog.ph4nt0m.xyz/ko/cves/cve-2026-52130/)
- [https://github.com/ggml-org/llama.cpp](https://github.com/ggml-org/llama.cpp)

## Related threats

- [llama.cpp integer overflow in gguf_init_from_reader](https://junglewise.ai/threats/cve-2026-116840-llama-cpp-b5854-before-b11275-contains-an-integer-overflow)
- [llama.cpp denial of service via negative top_n in reranking API](https://junglewise.ai/threats/cve-2026-52132-llama-cpp-denial-of-service-via-negative-top-n-in-reranking-api)
- [llama.cpp uncontrolled recursion in JSON schema converter](https://junglewise.ai/threats/cve-2026-52130-llama-cpp-uncontrolled-recursion-in-json-schema-converter)
- [llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI…](https://junglewise.ai/threats/cve-2026-70640-llama-cpp-builds-b1886-through-b7445-contain-a-race-condition-use)
- [llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper…](https://junglewise.ai/threats/cve-2026-70639-llama-cpp-builds-b1886-through-b7445-contain-a-null-pointer)