Resource Allocation Flaw in ggml-org Llama.cpp Component
CVE-2026-17501

6.9MEDIUM

Key Information:

Vendor

Ggml-org

Status
Llama.cpp
Vendor
CVE Published:
27 July 2026

What is CVE-2026-17501?

A resource allocation vulnerability has been identified in the JSON-Schema-to-GBNF conversion component of ggml-org's Llama.cpp. This flaw occurs in the 'transform' function located in common/json-schema-to-grammar.cpp, enabling potential attackers to exploit the vulnerability remotely. The flaw arises from improper handling of resource allocation, which could lead to uncontrolled recursion and subsequent resource depletion. A pull request addressing this vulnerability is pending acceptance. Immediate attention is advised for users of the affected product.

Affected Version(s)

llama.cpp e15efe0

References

https://vuldb.com/vuln/383354
vdb-entrytechnical-description
https://vuldb.com/vuln/383354/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-17501
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

m00dy (VulDB User)
VulDB CNA Team
.