CVE-2026-119052

Oversized llama.cpp RPC messages can terminate the inference server

ggml-org · llama.cpp ggml-rpc server

First documented disclosure · Review checkpoint

Summary

An unauthenticated reachable client can crash the RPC service with an oversized message length.

Severity and exploitation evidence

High · 8.7/10 · CVSS 4.0. Severity source.

Exploitation not established: The public fix describes controlled plain/ASan verification of server survival after rejecting oversized input. No malicious exploitation or victim incident is established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

recv_msg resizes a buffer from a client-supplied length. Values beyond vector::max_size throw length_error, which the existing bad_alloc handler does not catch.

Conditions required

Network access to the RPC listener, completion of its HELLO handshake and a variable-length RPC command.

Potential impact

RPC process termination and loss of service for its clients. Confidentiality or integrity compromise is not established.

Affected versions and configurations

Builds b2877 through those before b11935.

Fix and mitigation status

b11935 catches length_error and drops the offending connection.

Practical next steps

Update to a supported build containing b11935 and restrict the RPC listener to trusted clients; validate message sizes before allocation.

Operating lesson

Model-serving control planes need bounded protocol parsers as well as model-input limits.

Evidence and limits

Public PR 31204 opened October 26, merged October 27 and shipped in b11935 October 27. The CNA's October 27 datePublic and October 29 registration are later milestones. This is a service-availability defect, not a claim that arbitrary code execution was shown.

Sources