CVE-2026-52130

A flaw was found in llama.cpp. This vulnerability, caused by uncontrolled recursion in the common/json-schema-to-grammar.cpp component, allows an attacker to trigger a denial of service. This can lead to the affected system becoming unresponsive or unavailable.

A flaw was found in llama.cpp within the json-schema-to-grammar component. Processing a specially crafted, deeply nested JSON schema can trigger uncontrolled recursion during grammar conversion. A remote, unauthenticated attacker could send a malicious schema payload to exhaust system memory or crash the application, resulting in a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict or disable API endpoints that accept custom JSON schemas or user-defined grammars. If untrusted schema processing is required, implement pre-parsing input validation at the API gateway to reject deeply nested JSON structures prior to passing them to llama.cpp.