llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service (std::bad_alloc and HTTP 500) via a negative top_n value in a POST request to /rerank.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HGgml Llama.cpp
APPGgmlβ€ 0.4.0
π΅
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
DoS
CWE
Related vulnerabilities
CVE-2026-34159CRITICAL9.8PL βsame product
RCE w llama.cpp β brak walidacji granic w RPC backend (deserialization)
CVE-2024-42479CRITICAL10.0PL βsame product
Zapis pod dowolny adres pamiΔci w llama.cpp poprzez wskaΕΊnik rpc_tensor
CVE-2026-52130HIGH7.5same product
llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resul...
CVE-2026-52131HIGH7.5same product
llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function.
CVE-2026-43622HIGH8.5PL βsame product
Double free w llama.cpp Android JNI β RCE lub DoS