CVE-2026-119052— llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length

Quick assessment

Copy summary Copy citation

Affected

ggml-org llama.cpp

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

llama.cpp 从 b2877 版本到 b11935 版本（不含）的 ggml-rpc 服务器中存在一个未捕获异常漏洞。该漏洞允许未经身份验证的远程攻击者通过发送超大消息长度，导致 rpc-server 崩溃。在完成 HELLO 握手后，攻击者可发送如 SET_TENSOR 等命令，并指定超过 std::vector::max_size() 的长度，从而触发未捕获的 std::length_error 异常，导致进程终止，进而使所有客户端无法获得服务（拒绝服务）。

CVE-2026-119052 affects ggml-org llama.cpp. No confirmed in-the-wild exploitation; assess based on exposure. llama.cpp 从 b2877 版本到 b11935 版本（不含）的 ggml-rpc 服务器中存在一个未捕获异常漏洞。该漏洞允许未经身份验证的远程攻击者通过发送超大消息长度，导致 rpc-server 崩溃。在完成 HELLO 握手后，攻击者可发送如 SET_TENSOR 等命令，并指定超过 std::vector::max_size() 的长度，从而 CVE-2026-119052 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2026-119052

I. Basic Information for CVE-2026-119052

Affected Products

II. Public POCs for CVE-2026-119052

III. Intelligence Information for CVE-2026-119052

Patches & Fixes for CVE-2026-119052 (2)

• 🔗 rpc : catch std::length_error in recv_msg by sohaibharraoui · Pull Request #31204 · ggml-org/llama.cpp patch issue-tracking
• 🔗 rpc : catch std::length_error in recv_msg (#31204) · ggml-org/llama.cpp@7ecb57f · GitHub patch

Vendor Advisories for CVE-2026-119052 (1)

• 🔗 llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length | Advisories | VulnCheck third-party-advisory

Vendor Pages for CVE-2026-119052 (2)

• 🔗 GitHub - ggml-org/llama.cpp: LLM inference in C/C++ · GitHub product
• Release b11935 · ggml-org/llama.cpp · GitHub release-notes

• https://www.cve.org/CVERecord?id=CVE-2026-119052

IV. Related Vulnerabilities