CVE-2026-107183
Description
A flaw was found in llama.cpp. An unauthenticated remote attacker could exploit this vulnerability by submitting a specially crafted completion request with malformed chat parser parameters. Due to improper memory handling, this request triggers a use-after-free condition that corrupts memory. This flaw can potentially lead to arbitrary code execution or cause a Denial of Service (DoS) by crashing the server.
Statement
Red Hat has rated this vulnerability as Critical because unauthenticated remote attackers can cause memory corruption without requiring prior privileges or user interaction. When the inference service processes untrusted HTTP completion requests, malformed chat parser payloads can cause an application crash or enable arbitrary code execution within the host environment. Deployments that run the component strictly in offline batch modes or isolate API endpoints from untrusted network traffic experience significantly reduced risk.
Mitigation
Restrict network exposure of the llama-server service to trusted network segments or localhost using firewall rules or reverse proxy controls.
1. Restrict access to the service port using firewalld:
firewall-cmd --permanent --zone=public --remove-port=8080/tcp
firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_RANGE>
firewall-cmd --reload
Alternatively, configure the server daemon to bind exclusively to the localhost interface (127.0.0.1) if remote connectivity is not required.
Caveats: Limiting network reachability prevents untrusted remote clients from sending completion requests, which will impact external integrations and client applications that rely on remote API access.
Warning: Reloading firewall rules or restarting the service daemon will terminate active network connections and interrupt ongoing inference jobs.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
