CVE-2026-119052

{
  "etk_id": "ETK-2026-2972",
  "cve_id": "CVE-2026-119052",
  "display_id": "CVE-2026-119052",
  "ghsa_id": "GHSA-rr32-94xq-hrxw",
  "euvd_id": "EUVD-2026-112818",
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "Unauthenticated denial of service in llama.cpp ggml-rpc server",
  "summary": "llama.cpp ggml-rpc servers from b2877 through releases before b11935 can be terminated by malformed oversized request length data. An unauthenticated remote attacker can deny service to connected clients if they can reach the rpc-server and establish a protocol session.",
  "mitigation": "Upgrade llama.cpp to b11935 or later. Restrict network access to the ggml-rpc server to trusted clients until the upgrade is complete.",
  "vendor": "ggml-org",
  "product": "llama.cpp",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= b2877, < b11935"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "b11935"
      ],
      "package_name": "llama.cpp",
      "purl": null
    }
  ],
  "cwes": [
    248
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": null,
  "t0_at": "2026-10-29T13:08:52.886000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-29T13:08:52.886000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T13:08:52.886000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-119052"
    }
  }
}