https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Mon, 10 Aug 2026 08:42:43 +0000 https://vulnerability.circl.lu/sighting/330dcbde-8985-4bf8-9b9a-f2f93c2605c5/export {"uuid": "330dcbde-8985-4bf8-9b9a-f2f93c2605c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51233", "type": "seen", "source": "https://gist.github.com/programmervuln/698a3ca54a49126a23a60092240d933a", "content": "vulnerable code link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51233\nAffected Product\nllama.cpp\nAffected Versions\nAll versions prior to the fix for the HTTP server integer overflow vulnerability (server mode -s/--server).\nNote: This flaw only impacts instances launched with the --server / -s flag enabling the built-in HTTP web service.\nCVE ID\nCVE-2026-51233\nProse Vulnerability Description\nllama.cpp contains an integer overflow vulnerability within the HTTP request handling logic of its built-in server component. \nWhen processing unauthenticated inbound HTTP requests, the library parses the Content-Length header value supplied by the remote\nclient without performing overflow or upper-bound sanity checks. An attacker can provide an extremely large unsigned 64-bit Content-Length\nvalue (e.g., UINT64_MAX). When calculating the destination heap buffer size (buf_size = content_length + 1), integer overflow occurs, \ncollapsing the allocated buffer size to a very small value. The program then attempts to receive the full declared body length into this\nundersized heap buffer via recv(), triggering a heap buffer overflow. Successful exploitation allows an unauthenticated remote attacker \nto achieve arbitrary code execution with the privileges of the llama-server process or crash the service to create a denial of service condition.\nVulnerability Type\nInteger Overflow leading to Heap Buffer Overflow (CWE-190 \u2192 CWE-122)\nRoot Cause\nUnvalidated attacker-controlled Content-Length extracted from HTTP headers;\nUnsafe arithmetic buf_size = content_length + 1 with no overflow detection;\nHeap allocation uses the overflow-truncated small size;\nSubsequent recv() reads the full attacker-controlled body length into the undersized buffer, causing out-of-bounds heap write.\nImpact\nDenial of Service: Remote unauthenticated attackers can crash the llama-server process reliably.\nRemote Code Execution: Memory corruption from heap overflow may enable arbitrary code execution under the runtime user account running llama.cpp.\nPoC Rationale\nSend an HTTP POST request with Content-Length: 18446744073709551615 (UINT64_MAX).\ncontent_length + 1 overflows a 64-bit unsigned integer to 0; malloc(0) returns a minimal heap allocation. The server then attempts to \nreceive thousands/millions of bytes into this tiny buffer, triggering heap out-of-bounds write observable under AddressSanitizer.", "creation_timestamp": "2026-07-30T03:53:15.482267Z"} {"uuid": "330dcbde-8985-4bf8-9b9a-f2f93c2605c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51233", "type": "seen", "source": "https://gist.github.com/programmervuln/698a3ca54a49126a23a60092240d933a", "content": "vulnerable code link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51233\nAffected Product\nllama.cpp\nAffected Versions\nAll versions prior to the fix for the HTTP server integer overflow vulnerability (server mode -s/--server).\nNote: This flaw only impacts instances launched with the --server / -s flag enabling the built-in HTTP web service.\nCVE ID\nCVE-2026-51233\nProse Vulnerability Description\nllama.cpp contains an integer overflow vulnerability within the HTTP request handling logic of its built-in server component. \nWhen processing unauthenticated inbound HTTP requests, the library parses the Content-Length header value supplied by the remote\nclient without performing overflow or upper-bound sanity checks. An attacker can provide an extremely large unsigned 64-bit Content-Length\nvalue (e.g., UINT64_MAX). When calculating the destination heap buffer size (buf_size = content_length + 1), integer overflow occurs, \ncollapsing the allocated buffer size to a very small value. The program then attempts to receive the full declared body length into this\nundersized heap buffer via recv(), triggering a heap buffer overflow. Successful exploitation allows an unauthenticated remote attacker \nto achieve arbitrary code execution with the privileges of the llama-server process or crash the service to create a denial of service condition.\nVulnerability Type\nInteger Overflow leading to Heap Buffer Overflow (CWE-190 \u2192 CWE-122)\nRoot Cause\nUnvalidated attacker-controlled Content-Length extracted from HTTP headers;\nUnsafe arithmetic buf_size = content_length + 1 with no overflow detection;\nHeap allocation uses the overflow-truncated small size;\nSubsequent recv() reads the full attacker-controlled body length into the undersized buffer, causing out-of-bounds heap write.\nImpact\nDenial of Service: Remote unauthenticated attackers can crash the llama-server process reliably.\nRemote Code Execution: Memory corruption from heap overflow may enable arbitrary code execution under the runtime user account running llama.cpp.\nPoC Rationale\nSend an HTTP POST request with Content-Length: 18446744073709551615 (UINT64_MAX).\ncontent_length + 1 overflows a 64-bit unsigned integer to 0; malloc(0) returns a minimal heap allocation. The server then attempts to \nreceive thousands/millions of bytes into this tiny buffer, triggering heap out-of-bounds write observable under AddressSanitizer.", "creation_timestamp": "2026-07-30T03:53:15.482267Z"} https://vulnerability.circl.lu/sighting/330dcbde-8985-4bf8-9b9a-f2f93c2605c5/export Thu, 30 Jul 2026 03:53:15 +0000