CVE-2026-17501
Fixed in a distro release EPSS <1%CVSS 5.3
A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.
Products: ggml-org llama.cpp
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | firefox | 140.13.0-1.amzn2023.0.1 |
| Debian 14 | llama.cpp | no fix |
| Ubuntu 26.04 LTS | llama.cpp | no fix |
| Ubuntu 26.10 | llama.cpp | no fix |