Llama Cpp Security Patches

CVEs (5)

• CVE-2026-43632HigAug 6, 2026
  Vladimir Tokarev Cyera

  Llama Cpp Security Patches
  risk 0.53cvss 8.1epss 0.00

  llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens) that bypass the task queue and access…

• CVE-2026-43631HigAug 6, 2026
  Llama.cpp

  llama.cpp
  risk 0.53cvss 8.1epss 0.00

  llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary code. Attackers can trigger the…

• CVE-2026-43629HigAug 6, 2026
  Llama.cpp

  llama.cpp
  risk 0.53cvss 8.1epss 0.01

  llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_data() function computes write size without overflow checking, allowing attackers with write access to the slot_save_path directory to…

• CVE-2026-43628HigAug 6, 2026
  Vladimir Tokarev Cyera

  Llama Cpp Security Patches
  risk 0.51cvss 7.8epss 0.00

  llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the…

• CVE-2026-70640HigAug 6, 2026
  Ggml

  Llama.cpp
  risk 0.39cvss 7.0epss 0.00

  llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the…