CVE-2026-52132

Name of the Vulnerable Software and Affected Versions llama.cpp versions prior to commit 97f06e9

Description When started with the --reranking flag, the software is susceptible to a denial of service. A remote attacker can trigger a std::bad alloc (a memory allocation failure) and an HTTP 500 error by sending a negative value for the top n variable in a POST request to the '/rerank' endpoint.

Recommendations Update llama.cpp to a version beyond commit 97f06e9. As a temporary mitigation, avoid starting the application with the --reranking flag or restrict access to the '/rerank' endpoint.