CVE-2026-17501

EUVD-2026-49061
A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 35.3%
Debian logo
Debian Releases
Debian Product
Codename
llama.cpp
forky
vulnerable
sid
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
llama.cpp
jammy
dne
noble
dne
resolute
needs-triage
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
firefox
Amazon Linux 2023
0:140.13.0-1.amzn2023.0.1
fixed
firefox-debuginfo
Amazon Linux 2023
0:140.13.0-1.amzn2023.0.1
fixed
firefox-debugsource
Amazon Linux 2023
0:140.13.0-1.amzn2023.0.1
fixed
Common Weakness Enumeration
References
https://github.com/ggml-org/llama.cpp/
https://github.com/ggml-org/llama.cpp/issues/25283
https://github.com/ggml-org/llama.cpp/pull/25308
https://vuldb.com/cve/CVE-2026-17501
https://vuldb.com/submit/798504
https://vuldb.com/vuln/383354
https://vuldb.com/vuln/383354/cti