CVE-2026-119052
Description
A flaw was found in llama.cpp. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending a specially crafted request with an excessively large message length to the Remote Procedure Call (RPC) server. Handling this malformed input triggers an unhandled exception, crashing the server process and disrupting service for all connected clients.
Statement
This vulnerability is rated as Important because an unauthenticated remote attacker can force an immediate process termination without prior credentials or user interaction, causing a complete loss of service for connected clients. Exposure is limited to environments where the optional ggml-rpc daemon is explicitly executed and reachable across untrusted networks. Standalone local inference workloads do not expose network listeners and are unaffected.
Understanding the Weakness (CWE)
Availability,Confidentiality
Technical Impact: DoS: Crash, Exit, or Restart; Read Application Data
An uncaught exception could cause the system to be placed in a state that could lead to a crash, exposure of sensitive information, or other unintended behaviors.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
