PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-52130 ggml-org CVE debrief

The CVE record for CVE-2026-52130 was published on 2026-09-01T18:17:43.603Z and has not been modified since then. The NVD entry is currently Analyzed. This vulnerability affects llama.cpp, specifically in common/json-schema-to-grammar.cpp, allowing for uncontrolled recursion, which could lead to a denial of service. Security teams and administrators responsible for systems using llama.cpp should be aware of this vulnerability and take steps to verify and update their systems to prevent potential denial of service attacks.

Vendor
ggml-org
Product
llama.cpp
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-01
Original CVE updated
2026-09-04
Advisory published
2026-09-01
Advisory updated
2026-09-04

Who should care

Security teams and administrators responsible for systems using llama.cpp should be aware of this vulnerability and take steps to verify and update their systems to prevent potential denial of service attacks. This includes confirming whether affected product deployments exist in managed environments and assigning an owner for follow-up. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

CVE-2026-52130 is a vulnerability in llama.cpp, specifically in common/json-schema-to-grammar.cpp, which allows for uncontrolled recursion. This could lead to a denial of service. The vulnerability has a CVSS score of 7.5 and is considered HIGH severity. The affected version is b5693 and before. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified.

Defensive priority

Medium priority given the HIGH CVSS score of 7.5 for CVE-2026-52130, indicating a potential denial of service vulnerability in llama.cpp.

Recommended defensive actions

  • Verify the version of llama.cpp is beyond b5693.
  • Review and apply vendor patches or updates.
  • Monitor for any advisories or updates from Ggml regarding CVE-2026-52130.
  • Consider implementing compensating controls to mitigate potential denial of service attacks.
  • Conduct an inventory check to identify and update vulnerable systems.

Evidence notes

Evidence from the NVD and CVE Program indicates a denial of service vulnerability in llama.cpp due to uncontrolled recursion. Further verification is recommended. The affected version is b5693 and before. Additional verification tasks include reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and checking relevant monitoring, detection, and logs for exposed assets that need extra review.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-52130 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-52130

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-52130 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-52130

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.