llama.cpp ggml-rpc server: Denial of service via oversized message length
Summary
llama.cpp builds from b2877 up to b11935 contain an uncaught exception in the ggml-rpc server (rpc-server), used for distributed inference across machines. After the HELLO handshake, an unauthenticated remote attacker can send a command such as SET_TENSOR with a length above the maximum vector size, which aborts the process and makes the service unavailable to all clients. Only confidentiality and integrity are unaffected; the impact is availability. Exposure of the RPC port is the main risk factor.
Affected
- llama.cpp from b2877 up to, but not including, b11935, when the ggml-rpc backend / rpc-server is used.
- Whether earlier builds are affected is unknown.
Fixed in
- Upgrade to llama.cpp b11935 or later (released 27 Oct 2026, fix in PR #31204).
Workaround
- Unknown from vendor sources. Until patched, restrict access to the RPC port to trusted inference nodes using a firewall, VPN or mutually authenticated network.
- The project advises not to expose the RPC server on an untrusted network.
Exploitation
- No evidence of known exploitation in the wild.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Inventory hosts running rpc-server or an RPC backend listener and check their build versions.
- Patch affected hosts to b11935 or later.
- Until patched, block external access to the RPC port and limit it to trusted nodes.
- Verify separately that GHSA-j8rj-fmpv-wcxw (a different RPC issue) is addressed in your build.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- llama.cpp release b11935 github.com
- llama.cpp pull request #31204 (fix) github.com
- llama.cpp fix commit 7ecb57f github.com
- llama.cpp ggml-rpc.cpp source (affected code) github.com
- VulnCheck advisory www.vulncheck.com
- llama.cpp issue #30458 (RPC network exposure guidance) github.com
- llama.cpp security advisory GHSA-j8rj-fmpv-wcxw (separate issue) github.com
- llama.cpp project repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:41.
Original description (NVD)
llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attackers can send a command such as SET_TENSOR with a length above std::vector::max_size(), triggering an uncaught std::length_error that aborts the process and denies service to all clients.
NVD references (6)
- https://github.com/ggml-org/llama.cpp
- https://github.com/ggml-org/llama.cpp/blob/8542e94350f0ade01644db6f1d1520da3814dafd/ggml/src/ggml-rpc/ggml-rp…
- https://github.com/ggml-org/llama.cpp/commit/7ecb57f7adbea2928aa468ad2aecf05b10725ad4
- https://github.com/ggml-org/llama.cpp/pull/31204
- https://github.com/ggml-org/llama.cpp/releases/tag/b11935
- https://www.vulncheck.com/advisories/llama-cpp-b2877-before-b11935-ggml-rpc-server-dos-via-oversized-recv-msg…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.