Description

llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens) that bypass the task queue and access ctx_server.vocab directly on HTTP worker threads. Attackers can exploit a time-of-check-time-of-use race condition where the main thread destroys and frees vocab after the synchronization lock is released but before the handler finishes using it, causing a crash or potential code execution when --sleep-idle-seconds is configured.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-06T22:17:06.343Z",
  "pubdate": "2026-08-06T22:17:06.343Z",
  "executiveSummary": "A use-after-free vulnerability exists in llama-server within llama.cpp builds b7492 through the latest b9060. The flaw affects six specific tokenization endpoints: /tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens. These endpoints bypass the standard task queue and directly access the ctx_server.vocab object on HTTP worker threads. The impact of this vulnerability includes denial of service via application crashes and potential arbitrary code execution. The affected system is llama-server when configured with the --sleep-idle-seconds parameter. An attacker can exploit this flaw by leveraging a time-of-check-time-of-use race condition. Exploitation requires the main thread to destroy and free the vocab object after the synchronization lock is released but before the HTTP worker thread handler completes its execution. The risk implications are severe, as successful exploitation disrupts service availability and could potentially allow memory corruption and subsequent code execution on the host running the server.",
  "technicalDetails": "The vulnerability resides in the llama-server component of llama.cpp, specifically within HTTP request handlers for the /tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens endpoints. The root cause is a concurrency flaw and unsafe memory management resulting from bypassing the centralized task queue. Unlike operations routed safely through the queue, these specific endpoints directly access the ctx_server.vocab resource asynchronously on HTTP worker threads.\nThe vulnerability is triggered under specific runtime conditions, notably when the server is operating with the --sleep-idle-seconds configuration. This configuration enables idle state management where the main execution thread can deallocate and free core structures such as the vocabulary context to conserve resources or reset state. A time-of-check-time-of-use (TOCTOU) race condition occurs due to improper synchronization boundaries.\nThe attack flow proceeds as follows: First, an attacker sends concurrent or timed HTTP requests to one of the vulnerable endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, or /anthropic/count_tokens). Second, the HTTP worker thread accesses the ctx_server.vocab pointer, passing the initial synchronization check. Third, the main thread concurrently evaluates idle states under --sleep-idle-seconds, determines that the vocabulary is no longer required, and proceeds to destroy and free the memory associated with ctx_server.vocab. Finally, the HTTP worker thread resumes execution and attempts to dereference the now-freed memory address of the vocab object.\nAffected versions include llama.cpp builds b7492 through b9060. The vulnerability is network-exposed as it impacts HTTP server endpoints accessible over the network interface. Authentication and privilege requirements depend on the server deployment configuration, but typically unauthenticated network access to the HTTP endpoints is sufficient to trigger the race condition. The payload behavior involves inducing high request concurrency or manipulating idle timeouts to reliably win the race condition. Post-exploitation impact ranges from immediate process termination due to segmentation faults or memory access violations, leading to denial of service, to potential memory corruption scenarios that could be leveraged for arbitrary code execution depending on heap layout and allocator behavior."
}