CVE-2026-52132 ggml CVE debrief

Who should care

Defenders managing Llama.cpp deployments, especially those exposed to the /rerank endpoint, should assess their exposure and prioritize mitigation.

Why it matters

CVE-2026-52132 is a high-severity vulnerability in ggml's Llama.cpp that allows remote attackers to cause a denial of service. Defenders managing Llama.cpp deployments should assess their exposure and prioritize mitigation.

• Potential denial-of-service impact on Llama.cpp deployments
• Need to verify and restrict input values for the top_n parameter
• Possible update to the latest version of Llama.cpp

Technical summary

The vulnerability exists in llama.cpp through commit 97f06e9 when started with the --reranking flag. A remote attacker can cause a denial of service (std::bad_alloc and HTTP 500) via a negative top_n value in a POST request to /rerank. This issue is especially relevant for defenders managing Llama.cpp deployments, as they need to verify and restrict input values for the top_n parameter to mitigate potential denial-of-service attempts.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially those managing Llama.cpp deployments.

Recommended defensive actions

• Verify Llama.cpp deployments for exposure to the /rerank endpoint
• Restrict input values for the top_n parameter in POST requests to /rerank
• Monitor for and respond to potential denial-of-service attempts
• Update to the latest version of Llama.cpp if available

Evidence notes

The official CVE record and NVD detail page provide information on this vulnerability, including its CVSS score of 7.5 and potential denial-of-service impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.