CVE-2026-43628: llama.cpp b3978–b9058 Integer Underflow via DRY Sampler
llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dryallowedlength set to INT32MIN to the /v1/completions or /v1/chat/completions endpoints. Attackers can exploit this vulnerability to crash the server with SIGSEGV causing denial of service for all connected users, or corrupt token sampling probabilities by reading garbage values from memory before the allocated buffer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43628?
CVE-2026-43628 has a severity rating of 7.8, classified as high.
How do I fix CVE-2026-43628?
To fix CVE-2026-43628, update llama.cpp to a version that addresses the integer underflow vulnerability.
What type of vulnerability is CVE-2026-43628?
CVE-2026-43628 is an integer underflow and out-of-bounds read vulnerability.
Who is affected by CVE-2026-43628?
CVE-2026-43628 affects builds of llama.cpp from b3978 to b9058.
What impact does CVE-2026-43628 have?
CVE-2026-43628 allows unauthenticated attackers to cause a heap buffer underflow, potentially leading to code execution.