CVE-2026-43628 ggml-org CVE debrief

Who should care

Users and administrators of systems utilizing llama.cpp, especially those exposed to untrusted input or HTTP requests, should be aware of this vulnerability and take defensive actions to mitigate potential risks. This includes reviewing system configurations, monitoring for suspicious activity, and applying vendor remediation when available. Additionally, security teams and vulnerability management teams should prioritize this vulnerability and ensure that affected systems are properly mitigated. Operators of platforms using llama.cpp should also review their configurations and ensure that they are not exposed to untrusted input or HTTP requests. Vulnerability management teams should track this vulnerability and ensure that affected systems are properly mitigated. Security teams should review system configurations, monitor for suspicious activity, and apply vendor remediation when available. Asset owners should verify that their systems are not affected and take defensive actions to mitigate potential risks. System administrators should review system configurations, monitor for suspicious activity, and apply vendor remediation when available. Security administrators should prioritize this vulnerability and ensure that affected systems are properly mitigated. Compliance teams should review system configurations and ensure that they meet regulatory requirements. Audit teams should review system configurations and ensure that they are properly mitigated. Risk management teams should prioritize this vulnerability and ensure that affected systems are properly mitigated. Business stakeholders should be aware of this vulnerability and its potential impact on business operations. They should prioritize this vulnerability and ensure that affected systems are properly mitigated. Security officers should review system configurations, monitor for suspicious activity, and apply vendor remediation when available. Incident response teams should be prepared to respond to potential exploitation attempts. Threat intelligence teams should monitor for potential exploitation attempts and provide threat intelligence to security teams. Penetration testing teams should review system 0

Technical summary

The CVE-2026-43628 vulnerability is an integer underflow and out-of-bounds read issue in the DRY sampler of llama.cpp, allowing unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the /v1/completions or /v1/chat/completions endpoints. This vulnerability can cause denial of service for all connected users or corrupt token sampling probabilities by reading garbage values from memory before the allocated buffer. The vulnerability affects llama.cpp builds b3978 through b9058.

Defensive priority

High-priority defensive actions are required to address this vulnerability, as it allows unauthenticated attackers to trigger a heap buffer underflow, potentially causing denial of service or corrupting token sampling probabilities.

Recommended defensive actions

• Verify system configurations and inventory to identify potentially affected systems
• Monitor for suspicious activity and implement compensating controls
• Apply vendor remediation when available
• Perform regular security updates and patches
• Implement robust input validation and error handling

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but further verification is needed to confirm affected systems and assess potential impact. Defensive actions should focus on verifying system configurations, monitoring for suspicious activity, and applying vendor remediation when available. Evidence limits suggest that additional information may be required to fully understand the vulnerability's impact. Defenders should verify system configurations, review compensating controls, and monitor for potential exploitation attempts.

Official resources