{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-43631",
    "name": "CVE-2026-43631",
    "vendor": "llama.cpp builds b",
    "description": "A use-after-free on the vocab pointer in llama.cpp's llama-server lets an unauthenticated remote attacker run code by sending requests while the server is transitioning into sleep mode, a window in which concurrent worker threads dereference memory that has already been freed and that the attacker can reclaim with data of their own. It affects builds b7492 through b9060 and needs the --sleep-idle-seconds feature active, a flag commonly set on exactly the shared internal inference hosts that see the most sensitive prompts. Local inference also changes the exposure shape: these servers are usually stood up by a team rather than provisioned by IT, and frequently listen on the internal network with nothing authenticating in front of them.",
    "website": "https://github.com/advisories/GHSA-6hc7-9rph-cm99",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-08-07",
    "risk": {
      "score": 92,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-43631",
      "aliases": [
        "ti-082",
        "GHSA-6hc7-9rph-cm99"
      ],
      "title": "CVE-2026-43631: Unauthenticated RCE in llama-server When Idle Sleep Is Enabled (CVSS 9.2)",
      "summary": "A use-after-free on the vocab pointer in llama.cpp's llama-server lets an unauthenticated remote attacker run code by sending requests while the server is transitioning into sleep mode, a window in which concurrent worker threads dereference memory that has already been freed and that the attacker can reclaim with data of their own. It affects builds b7492 through b9060 and needs the --sleep-idle-seconds feature active, a flag commonly set on exactly the shared internal inference hosts that see the most sensitive prompts. Local inference also changes the exposure shape: these servers are usually stood up by a team rather than provisioned by IT, and frequently listen on the internal network with nothing authenticating in front of them.",
      "severity": "critical",
      "cvss": {
        "score": 9.2,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution"
      ],
      "componentType": "agent",
      "component": {
        "name": "llama.cpp builds b",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "llama.cpp builds b7492 to b9060 with --sleep-idle-seconds enabled",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-08-07",
      "modifiedAt": "2026-08-07",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "advisory",
          "url": "https://github.com/advisories/GHSA-6hc7-9rph-cm99"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43631"
        }
      ],
      "mitigation": "Update llama.cpp past b9060, or disable --sleep-idle-seconds as an immediate workaround. Then go and find the instances: local inference servers are typically stood up by a team rather than provisioned centrally, so inventory which machines run llama-server, check whether any is listening on a non-loopback interface, and put authentication and network policy in front of the ones that are.",
      "detectedByAnomity": true
    }
  }
}