llama.cpp: Llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in…
llama.cpp
More for llama.cpp RSS feed for llama.cpp
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Record
- CVE-2026-52130
- Affects
- llama.cpp
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 1, 2026
- Source last modified
- September 4, 2026
Description
llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service.
Description quoted from the NVD record.
Who is affected
This flaw affects llama.cpp, made by ggml. llama.cpp is software that runs AI language models on your own computers or servers so other programs can send it questions. Versions b5693 and earlier are affected. The problem is in the part of the product that turns a description of the expected answer format into rules the model must follow. Certain format descriptions can make that part keep repeating its own work until the program fails. This can crash llama.cpp or stop it from responding (a denial of service). This flaw is rated High.
What to do
- Find out who installed or runs llama.cpp for your organization. It may be a staff member, a volunteer, or an IT provider or vendor who manages it for you.
- If someone in your organization runs it, ask them to check whether the version in use is
b5693or earlier. - No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release and install it once it is available.
- If an IT provider or vendor runs llama.cpp for you, send them this advisory and ask when the update will be done.
Analysis written from the source record as of September 4, 2026 and reviewed before publishing.