External risk intelligence

llama.cpp Tokenization Use-After-Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-43632

The vulnerability affects the llama-server component, which provides HTTP endpoints for tokenization and model interaction. Because these endpoints are designed to be exposed as a network service to facilitate application integration and remote access to model inference capabilities, the surface is commonly deployed in an internet-facing or edge service role.

Use After Free

Ggml Llama Cpp

b7492 to b9060

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A recently identified vulnerability in llama.cpp's server component could allow an attacker to cause a denial-of-service or potentially execute code by exploiting a race condition in how server threads handle tokenization requests. This issue arises from improper management of memory when processing specific HTTP requests, particularly when the server is configured for idle timeouts.

Server issue allows unauthorized actions.
Affects services handling model requests.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by interacting with network-exposed llama-server endpoints, potentially triggering a race condition when the server is configured to idle. This occurs because the server might free up memory that is still in use by an active request handler, leading to instability or code execution.

No authentication required.
Race condition in tokenization endpoints.
Potential crash or code execution.

Live Threat

Current exploitation, exposure, and threat context

The `llama-server` component, when configured with `--sleep-idle-seconds`, could experience crashes or potential code execution due to a use-after-free vulnerability. This occurs in specific tokenization endpoints when a race condition allows the main thread to free memory before the HTTP worker thread finishes using it.

Server memory and service availability.
Race condition in tokenization endpoints.
Denial of service or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in llama-server's tokenization endpoints necessitates immediate action from teams managing AI/ML platforms and the underlying infrastructure. The first step is to locate all instances of llama.cpp, determine their exposure and business criticality, and identify the accountable owners for remediation.

Identify AI/ML platform owners.
Confirm network reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is llama.cpp and its server component?

llama.cpp is a popular open-source software project that enables efficient inference for large language models on consumer-grade hardware. The llama-server component is a specific part of this ecosystem designed to provide an HTTP interface. It allows applications to interact with these models remotely by exposing various endpoints, such as those used for converting text into tokens or generating model completions.

What does CVE-2026-43632 mean by use-after-free?

A use-after-free is a memory management weakness, identified here as CWE-416. It happens when software continues to use a memory address after that memory has been officially freed or released. In this vulnerability, the server's main thread may release memory (the vocabulary data) while an HTTP worker thread is still actively using it, leading to unpredictable program behavior, such as crashes or the potential for malicious code execution.

How is this race condition triggered?

The vulnerability involves a time-of-check-time-of-use race condition in specific tokenization endpoints. It is triggered when the server is actively using the --sleep-idle-seconds configuration. Requests sent to endpoints like /tokenize or /rerank bypass the standard task queue, allowing threads to access memory in an unsafe, overlapping manner. Importantly, this issue does not trigger under standard configurations where idle sleep is disabled.

Is my server at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a likely concern for many deployments. Because the llama-server is often used to provide network-accessible AI capabilities, it is frequently placed in internet-facing or edge service roles to facilitate remote integration. If your instance is reachable over a network rather than restricted to a local machine, you should consider it a priority for assessment.

What should I do first to manage this risk?

Start by performing an inventory of your AI and ML infrastructure to locate all instances of llama.cpp. Once identified, verify if they are running the affected build versions (b7492 through b9060) and if they are configured with the --sleep-idle-seconds flag. Coordinate with the platform owners to restrict network access to these endpoints until the underlying software can be updated.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.