CVE-2026-17501: llama.cpp DoS Vulnerability via Recursion

CVE-2026-17501 Overview

CVE-2026-17501 is an uncontrolled recursion vulnerability [CWE-404] in ggml-org llama.cpp at commit e15efe0. The flaw resides in the transform function of common/json-schema-to-grammar.cpp, part of the JSON-Schema-to-GBNF conversion component. A remote attacker can submit a crafted JSON schema that triggers unbounded recursive processing, leading to resource exhaustion and denial of service against the affected llama.cpp instance. Exploitation requires no authentication and no user interaction. A pull request addressing the issue is pending acceptance in the upstream repository.

Critical Impact
Remote, unauthenticated attackers can crash llama.cpp inference endpoints that accept JSON schema input by triggering uncontrolled recursion during grammar conversion.

Affected Products

ggml-org llama.cpp at commit e15efe0
Deployments exposing the JSON-Schema-to-GBNF conversion path
Applications embedding llama.cpp common/json-schema-to-grammar.cpp

Discovery Timeline

2026-07-27 - CVE-2026-17501 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-17501

Vulnerability Analysis

The vulnerability lives in the transform function inside common/json-schema-to-grammar.cpp. This code converts a user-supplied JSON schema into a GBNF (GGML Backus-Naur Form) grammar used to constrain model output. The transform routine walks schema nodes recursively without enforcing a depth limit or detecting cyclic structures.

An attacker who can submit a JSON schema to an llama.cpp endpoint can craft deeply nested or self-referencing schema constructs. Each nested element causes another stack frame in transform, and the recursion continues until the process exhausts stack space and aborts. The result is a denial-of-service condition affecting availability of the inference service.

The flaw is classified under [CWE-404: Improper Resource Shutdown or Release]. The attack is initiated over the network, and no privileges or user interaction are required. Confidentiality and integrity are not impacted; only availability is affected.

Root Cause

The transform function lacks recursion depth accounting and cycle detection when walking arbitrary JSON schema input. Because llama.cpp accepts caller-controlled schema definitions to drive constrained decoding, the recursion boundary is effectively attacker-controlled.

Attack Vector

An attacker submits a crafted JSON schema to any interface that forwards schema data into json-schema-to-grammar conversion. This includes HTTP-based inference servers built on llama.cpp that expose grammar or schema parameters in their request bodies. The malicious schema triggers stack exhaustion inside transform, terminating the server process.

No verified exploit code is publicly available. The vulnerability mechanism is documented in the GitHub Issue Tracker and the pending GitHub Pull Request.

Detection Methods for CVE-2026-17501

Indicators of Compromise

Unexpected crashes or restarts of llama.cpp server processes with stack overflow or segmentation fault signatures
Inbound HTTP requests to inference endpoints containing deeply nested or self-referential JSON schema payloads
Repeated abrupt terminations of grammar-processing threads correlated with client-supplied json_schema parameters

Detection Strategies

Inspect application logs for aborts originating in json-schema-to-grammar.cpp or the transform call stack
Apply request-size and schema-depth validation at the API gateway before payloads reach llama.cpp
Alert on repeated malformed or oversized json_schema fields from the same client IP within short windows

Monitoring Recommendations

Track process availability and crash counters for llama.cpp-based inference services
Capture full request bodies for grammar and schema parameters to support post-incident analysis
Baseline normal schema complexity to detect anomalous nesting depth or size

How to Mitigate CVE-2026-17501

Immediate Actions Required

Restrict network access to llama.cpp endpoints exposing JSON schema input to trusted clients only
Enforce input validation that rejects JSON schemas exceeding a defined nesting depth or byte size
Disable the JSON-Schema-to-GBNF feature where not required by the application

Patch Information

No released patch is currently available. The upstream fix is proposed in the pending GitHub Pull Request #25308 against the ggml-org/llama.cpp repository. Additional details are tracked in the VulDB CVE Entry. Rebuild llama.cpp from a commit that includes the accepted fix once the pull request is merged.

Workarounds

Place a reverse proxy in front of llama.cpp that validates and caps JSON schema depth and size
Run llama.cpp under a process supervisor with automatic restart and resource limits to contain crashes
Deploy llama.cpp inside isolated containers with restricted stack and memory ceilings
Reject client requests containing $ref cycles or nested schema structures beyond a safe threshold

bash

# Configuration example: nginx request body and depth guard for llama.cpp upstream
http {
    client_max_body_size 32k;
    limit_req_zone $binary_remote_addr zone=llama:10m rate=10r/s;

    server {
        listen 443 ssl;
        location /completion {
            limit_req zone=llama burst=20 nodelay;
            # Reject payloads with excessive nesting before forwarding
            if ($request_body ~* "(\{[^}]*){64,}") { return 413; }
            proxy_pass http://llama_cpp_upstream;
        }
    }
}