CVE-2026-52130: llama.cpp DOS Vulnerability via Recursion

CVE-2026-52130 Overview

CVE-2026-52130 is an uncontrolled recursion vulnerability in llama.cpp, the popular C/C++ inference engine for large language models. The flaw resides in common/json-schema-to-grammar.cpp and affects llama.cpp build b5693 and earlier. A remote attacker can submit a crafted JSON schema that triggers unbounded recursive processing, exhausting stack resources and crashing the process. This produces a denial of service condition against any application or service that exposes llama.cpp grammar conversion to untrusted input. The weakness is classified under CWE-674: Uncontrolled Recursion.

Critical Impact
Remote, unauthenticated attackers can crash llama.cpp inference servers by submitting malicious JSON schemas, disrupting LLM-backed applications.

Affected Products

llama.cpp build b5693
All llama.cpp releases prior to b5693
Downstream applications embedding vulnerable common/json-schema-to-grammar.cpp code

Discovery Timeline

2026-09-01 - CVE-2026-52130 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-52130

Vulnerability Analysis

The vulnerability lives in common/json-schema-to-grammar.cpp, a component that converts user-supplied JSON schemas into GBNF grammars used to constrain LLM output. The converter walks schema structures recursively without enforcing a maximum recursion depth. An attacker who controls the JSON schema input can craft deeply nested or self-referential schema constructs that cause the converter to recurse until the process stack is exhausted.

When the stack limit is reached, the host process terminates abnormally. In server deployments, this ends active inference sessions and interrupts downstream services. The impact is limited to availability. The vulnerability does not expose data or permit code execution.

Root Cause

The root cause is missing recursion depth accounting in the schema-to-grammar conversion path. Functions that traverse nested schema objects, $ref references, anyOf, oneOf, and allOf combinators, or nested properties invoke themselves without a counter or iterative rewrite. This matches the [CWE-674] pattern of uncontrolled recursion driven by attacker-influenced input structure.

Attack Vector

Exploitation requires network access to an endpoint that accepts JSON schemas and forwards them to llama.cpp grammar generation. This includes llama-server deployments and third-party wrappers that expose structured output or grammar-constrained generation features. No authentication or user interaction is required when the endpoint is publicly reachable. An attacker submits a crafted schema payload with recursive or excessively nested constructs. The llama.cpp process consumes stack frames until it crashes, taking the inference service offline. Additional technical detail is available in the Ph4nt0m Blog analysis of CVE-2026-52130 and the llama.cpp source repository.

Detection Methods for CVE-2026-52130

Indicators of Compromise

Repeated crashes or restarts of llama-server or applications embedding llama.cpp
Segmentation faults or stack overflow signals (SIGSEGV) in process logs correlated with JSON schema requests
HTTP requests to grammar or structured-output endpoints containing deeply nested JSON schema objects or self-referential $ref fields

Detection Strategies

Inspect application logs for abnormal termination events tied to json-schema-to-grammar.cpp call stacks
Alert on inbound requests where JSON schema payload nesting depth exceeds a safe threshold
Correlate process crash events with the source IP addresses submitting schema payloads to identify probing activity

Monitoring Recommendations

Track process uptime and restart counts for llama.cpp-based services and alert on anomalous restart rates
Enable request logging with payload size metrics on any endpoint accepting user-supplied schemas
Forward crash telemetry and web access logs to a centralized analytics platform for correlation across hosts

How to Mitigate CVE-2026-52130

Immediate Actions Required

Upgrade llama.cpp to a build later than b5693 that includes the fix for common/json-schema-to-grammar.cpp
Restrict network exposure of grammar and structured-output endpoints to authenticated internal clients only
Enforce input size and nesting-depth limits on JSON schema payloads at an application gateway or reverse proxy

Patch Information

Update to the latest llama.cpp release from the ggml-org/llama.cpp repository. Rebuild any downstream projects that vendor or statically link common/json-schema-to-grammar.cpp. Verify build metadata to confirm the deployed version is later than b5693.

Workarounds

Disable JSON schema-based grammar features if the deployment does not require constrained decoding
Place a validating reverse proxy in front of the inference service to reject schemas exceeding a fixed depth or size
Run llama.cpp under a process supervisor with restart limits to reduce sustained outage windows during exploitation attempts

bash

# Example: reject oversized or deeply nested schema payloads at an NGINX gateway
client_max_body_size 64k;

location /v1/grammar {
    if ($request_method = POST) {
        # Enforce size cap; combine with a WAF rule for depth checks
        client_body_buffer_size 64k;
    }
    proxy_pass http://llama_backend;
}