CVE-2026-18581: llama.cpp Reachable Assertion Vulnerability

CVE-2026-18581 Overview

CVE-2026-18581 is a reachable assertion vulnerability in ggml-org/llama.cpp at commit e15efe0. The flaw resides in the common/jinja/parser.cpp file, part of the Jinja Minja Template Parser component. An attacker with local access can supply the crafted input {{9|9|{ to trigger the assertion, causing the process to abort. The issue is classified under CWE-617: Reachable Assertion. A public disclosure exists, and the upstream project had not responded to the issue report at the time of publication. The vulnerability affects availability only and does not permit code execution or data exposure.

Critical Impact
A local attacker supplying a specific Jinja template input can crash llama.cpp processes that rely on the affected template parser, leading to service disruption for inference workloads.

Affected Products

ggml-org llama.cpp at commit e15efe0
Component: Jinja Minja Template Parser (common/jinja/parser.cpp)
Downstream tools and services embedding the affected llama.cpp build

Discovery Timeline

2026-08-03 - CVE-2026-18581 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18581

Vulnerability Analysis

The vulnerability lives in the Jinja template parsing logic implemented in common/jinja/parser.cpp inside the llama.cpp project. The parser handles template expressions used to format prompts and chat messages before they are passed to model inference. When the parser processes the malformed expression {{9|9|{, it reaches an internal assertion that fails, terminating the process. Because llama.cpp is commonly used as a backend for local inference servers and chat interfaces, an abort in this code path removes availability of the running service until it is restarted.

Root Cause

The root cause is an unvalidated parser state combined with an assertion used as a runtime check rather than for defensive programming. The Jinja Minja parser assumes certain grammar invariants hold after tokenization. The input {{9|9|{ violates those invariants by chaining pipe operators followed by an unterminated brace. Instead of returning a parse error to the caller, the parser reaches the assertion branch, which calls abort() in release builds compiled with assertions enabled. This matches the pattern described in CWE-617.

Attack Vector

Exploitation requires local access and low privileges. An attacker who can submit template input to a llama.cpp process — for example, through a chat template configuration file, a local API endpoint, or a shared prompt configuration — can send the trigger string to crash the process. No user interaction and no elevated privileges are required beyond the ability to feed input into the template parser. The vulnerability does not yield code execution, data disclosure, or integrity impact.

See the upstream issue report at GitHub Issue #25282 and the VulDB entry for CVE-2026-18581 for reference material.

Detection Methods for CVE-2026-18581

Indicators of Compromise

Unexpected SIGABRT terminations of llama-server, llama-cli, or embedding processes linked against affected llama.cpp builds
Log entries or core dumps referencing common/jinja/parser.cpp in the crashing stack frame
Presence of the substring {{9|9|{ or similar malformed Jinja expressions in prompt logs, chat template files, or API request bodies

Detection Strategies

Monitor process exit codes and crash telemetry for llama.cpp binaries and restart loops in supervising services such as systemd or container orchestrators
Inspect chat template configuration files and API request payloads for malformed Jinja constructs containing chained pipe characters and unbalanced braces
Correlate abort signals with the specific commit hash e15efe0 or earlier vulnerable builds identified by the deployed binary version

Monitoring Recommendations

Enable core dump collection on hosts running local inference services and alert on repeated crashes within short time windows
Log all inbound template inputs at the API gateway or reverse proxy layer for later inspection
Track llama.cpp build provenance across your environment so vulnerable commits can be identified and prioritized for update

How to Mitigate CVE-2026-18581

Immediate Actions Required

Restrict local access to hosts running llama.cpp so only trusted users and services can submit template input
Validate and sanitize any user-controllable Jinja template content before passing it to the parser
Rebuild llama.cpp from a commit later than e15efe0 once the upstream project publishes a fix for GitHub Issue #25282

Patch Information

At the time of publication, the upstream ggml-org/llama.cpp project had not responded to the issue report and no official patch was available. Track the llama.cpp repository and GitHub Issue #25282 for a fix, and update to a version that removes the reachable assertion in common/jinja/parser.cpp.

Workarounds

Disable Jinja chat templates or switch to a non-Jinja prompt format where the deployment allows it
Wrap the inference process in a supervisor that rate-limits restarts and rejects clients that repeatedly cause aborts
Apply an input filter at the API layer that rejects template payloads containing chained pipes followed by unbalanced braces

bash

# Configuration example: reject suspicious Jinja input at a reverse proxy layer
# nginx snippet - drop requests carrying the known trigger substring
if ($request_body ~* "\{\{[0-9]+\|[0-9]+\|\{") {
    return 400;
}