CVE-2026-52130 in llama.cpp
Summary
by MITRE • 09/01/2026
llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in llama.cpp prior to build version 5693 represents a critical flaw within the JSON schema processing logic, specifically located in the file common/json-schema-to-grammar.cpp. This component is responsible for translating structured data definitions into grammar rules that guide large language model inference. The core technical issue stems from uncontrolled recursion during the parsing and conversion of complex or deeply nested JSON schemas. When the system encounters a schema with recursive structures or excessive nesting depth, the internal algorithm fails to implement adequate safeguards such as maximum depth limits or cycle detection mechanisms. Consequently, this triggers an infinite loop or exponential growth in function calls that rapidly exhausts available stack space, leading directly to application crash and denial of service conditions for users attempting to process malformed or complex inputs through the affected versions.
From a technical perspective, this flaw aligns with CWE-675, which describes operations on data with insufficiently controlled recursion depth. The absence of proper boundary checks allows an attacker who can supply arbitrary JSON schemas to force the application into a state where it consumes all available memory or CPU resources before terminating abnormally. This is not merely a theoretical risk but a practical vector for denial of service attacks against services that expose llama.cpp functionality via API endpoints, particularly in scenarios involving user-generated content such as prompt engineering tools, automated data processing pipelines, or interactive chat interfaces that dynamically generate schema-based constraints. The impact extends beyond simple application instability; it can lead to resource exhaustion on the host system if not properly isolated, potentially affecting other processes sharing the same environment resources.
In terms of threat modeling and industry standards, this vulnerability is categorized under MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically utilizing resource exhaustion via application logic flaws rather than network flooding or brute force methods. The attack vector typically involves remote interaction if the service is exposed over a network, making it a Remote Code Execution precursor in some contexts where denial of service can be leveraged to disrupt security monitoring or availability guarantees. Security analysts should note that this type of vulnerability often arises from complex parsing libraries attempting to handle recursive data structures without implementing iterative approaches or explicit depth counters. The lack of input validation regarding schema complexity allows malicious actors to craft specific JSON payloads designed to trigger the deepest possible recursion paths within the grammar generation logic, thereby maximizing resource consumption with minimal payload size.
Mitigation strategies for this vulnerability primarily involve upgrading to llama.cpp version 5693 or later, where developers have implemented necessary controls such as maximum recursion depth limits and improved error handling for malformed schemas. For environments unable to upgrade immediately, deploying a Web Application Firewall (WAF) or API gateway with strict input validation can help filter out excessively complex JSON structures before they reach the vulnerable component. Additionally, implementing resource constraints at the operating system level, such as memory limits via cgroups on Linux systems or job objects in Windows, can contain the impact of any successful exploitation attempt by preventing a single process from consuming all host resources. Regular security audits focusing on recursive algorithms and parser implementations are recommended to prevent similar issues in future development cycles, ensuring that input complexity is bounded effectively against potential abuse vectors inherent in dynamic schema processing logic.