CVE-2026-43632
Description
A flaw was found in llama.cpp. A use-after-free vulnerability exists in the llama-server's tokenization endpoints. This flaw allows a remote attacker to exploit a time-of-check-time-of-use race condition, where memory is freed by the main thread before an HTTP worker thread finishes using it. Successful exploitation could lead to a system crash or potentially arbitrary code execution.
Statement
A use-after-free vulnerability was discovered in the llama-server component of llama.cpp. The flaw exists across six tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens) that bypass the main task queue and access ctx_server.vocab directly on worker threads. When the service is configured with the --sleep-idle-seconds option, an unauthenticated remote attacker can exploit a time-of-check-to-time-of-use (TOCTOU) race condition. This occurs when the main thread releases synchronization locks and destroys the vocabulary structure while an HTTP worker thread is still actively processing a request.
An unauthenticated remote attacker sending concurrent HTTP requests can trigger heap corruption, leading to a service crash (Denial of Service) or potential arbitrary code execution within the security context of the llama-server process. Because exploitation relies on tight timing windows during idle cleanup cycles and impact is contained within the process boundaries without inherent host privilege escalation or OS isolation bypass, this vulnerability has been rated with an Important severity. Due to these reasons, this vulnerability has been rated with an Important severity.
Mitigation
To mitigate this issue, avoid configuring the `llama-server` with the `--sleep-idle-seconds` option. Disabling this option prevents the specific race condition that leads to the use-after-free vulnerability. If `llama-server` is running as a service, a restart of the service will be required for the change to take effect.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Modify Application Data; Modify Memory; DoS: Crash, Exit, or Restart; Execute Unauthorized Code or Commands
It may be possible to cause data corruption and possibly execute arbitrary code by modifying global variables or data structures at unexpected times, violating the assumptions of code that uses this global data.
Access Control
Technical Impact: Gain Privileges or Assume Identity
If a signal handler interrupts code that is executing with privileges, it may be possible that the signal handler will also be executed with elevated privileges, possibly making subsequent exploits more severe.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
