Description

llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-01T18:17:43.603Z",
  "pubdate": "2026-09-01T18:17:43.603Z",
  "executiveSummary": "The vulnerability identified in llama.cpp up to version b5693 is classified as Uncontrolled Recursion, which facilitates a Denial of Service (DoS) condition.\nThis flaw resides within the json-schema-to-grammar.cpp component, specifically impacting the logic responsible for parsing complex or deeply nested JSON schemas into grammar structures.\nBy providing a specially crafted, deeply nested JSON schema, an unauthenticated attacker can induce stack exhaustion through excessive recursion.\nThe impact of this vulnerability is the termination of the llama.cpp process, resulting in service unavailability.\nThis vulnerability poses a significant risk to applications that utilize llama.cpp to process user-supplied JSON schemas for constrained output generation.\nNo specific privilege requirements are noted for exploitation; the attacker simply needs the ability to supply an input schema to the vulnerable function.\nDefensive posture requires input validation and resource constraints on schema processing.",
  "technicalDetails": "The root cause of the vulnerability is an unbounded recursive function call within the json-schema-to-grammar.cpp file. The function tasked with translating JSON schema definitions into grammar rules fails to implement sufficient depth limiting or cycle detection when traversing recursive schema definitions (e.g., schemas utilizing circular references or excessive nesting).\nWhen the parser encounters a deeply nested or self-referential structure, it attempts to resolve the schema by recursively calling itself. Because there is no check on the recursion depth or the current stack size, the application continues to push stack frames until the thread reaches its stack limit.\nThe attack flow proceeds as follows: 1) An attacker identifies an application endpoint or interface that accepts a user-provided JSON schema to define output constraints for llama.cpp. 2) The attacker crafts a malicious JSON payload containing deeply nested objects or properties (e.g., a schema that references itself or a tree structure of extreme depth). 3) The attacker submits this payload to the vulnerable system. 4) Upon processing the input, common/json-schema-to-grammar.cpp enters an uncontrolled recursive loop. 5) The operating system triggers a stack overflow exception due to the exhaustion of memory allocated for the execution thread's stack. 6) The llama.cpp process terminates unexpectedly, resulting in a Denial of Service.\nThis vulnerability affects versions b5693 and all prior versions. The exploitation does not require authentication or elevated privileges, as the vulnerability is triggered by the inherent parsing logic of the input data. The exposure is local to the parsing process, but in a production environment where an API allows users to provide custom schemas, this can be exploited remotely by sending the crafted payload to the API.\nThe post-exploitation impact is limited to process crashes, as the uncontrolled recursion prevents the application from gracefully handling the malformed input. Because the crash occurs in the parsing phase, it precludes the execution of intended model inference tasks, thereby disrupting the availability of the AI service. No arbitrary code execution is typically associated with this specific type of stack exhaustion vulnerability, though it serves as a critical vector for service disruption."
}