llama.cpp - Debian Package Tracker

general

source: llama.cpp (main)
version: 10271+dfsg-1
maintainer: Debian Deep Learning Team (archive) (DMD)
uploaders: Christian Kastner [DMD] – Mathieu Baudier [DMD]
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

testing: 10271+dfsg-1
unstable: 10344+dfsg-1

versioned links

10271+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
10344+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libllama-dev
libllama0
llama.cpp (1 bugs: 0, 1, 0, 0)
llama.cpp-examples
llama.cpp-services
llama.cpp-tests
llama.cpp-tools
llama.cpp-tools-extra
python3-gguf

action needed

Marked for autoremoval on 31 August due to chromium, golang-github-masterminds-sprig, httpcore, node-ipydatagrid, node-playwright, node-yarnpkg, towncrier, wasmedge: #1128867, #1133663, #1135849, #1138720, #1141793, #1143319, #1143321, #1143345, #1143428 high

Version 10271+dfsg-1 of llama.cpp is marked for autoremoval from testing on Mon 31 Aug 2026. It depends (transitively) on chromium, golang-github-masterminds-sprig, httpcore, node-ipydatagrid, node-playwright, node-yarnpkg, towncrier, wasmedge, affected by #1128867, #1133663, #1135849, #1138720, #1141793, #1143319, #1143321, #1143345, #1143428. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-08-01 Last update: 2026-08-11 20:32

A new upstream version is available: 10331 high

A new upstream version 10331 is available, you should consider packaging it.

Created: 2026-08-01 Last update: 2026-08-11 18:30

9 security issues in sid high

There are 9 open security issues in sid.

9 important issues:

CVE-2026-2069: A flaw has been found in ggml-org llama.cpp up to 55abc39. Impacted is the function llama_grammar_advance_stack of the file llama.cpp/src/llama-grammar.cpp of the component GBNF Grammar Handler. This manipulation causes stack-based buffer overflow. The attack needs to be launched locally. The exploit has been published and may be used. Patch name: 18993. To fix this issue, it is recommended to deploy a patch.
CVE-2026-17500: A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function _visit_pattern of the file common/json-schema-to-grammar.cpp. The manipulation results in null pointer dereference. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.
CVE-2026-17501: A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.
CVE-2026-18581: A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input {{9|9|{ can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-43627: llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries.
CVE-2026-43628: llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the /v1/completions or /v1/chat/completions endpoints. Attackers can exploit this vulnerability to crash the server with SIGSEGV causing denial of service for all connected users, or corrupt token sampling probabilities by reading garbage values from memory before the allocated buffer.
CVE-2026-43629: llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_data() function computes write size without overflow checking, allowing attackers with write access to the slot_save_path directory to corrupt heap memory. Attackers can craft malicious state files where cell_count multiplication overflows or exceeds tensor buffer allocation to write attacker-controlled bytes past buffer boundaries, potentially resulting in heap metadata corruption, model weight corruption, or arbitrary code execution via function pointer overwrite.
CVE-2026-43631: llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary code. Attackers can trigger the vulnerability by sending requests to affected endpoints while the server transitions to sleep mode, causing concurrent worker threads to dereference a freed vocab pointer that can be reclaimed with attacker-controlled data to achieve remote code execution.
CVE-2026-43632: llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens) that bypass the task queue and access ctx_server.vocab directly on HTTP worker threads. Attackers can exploit a time-of-check-time-of-use race condition where the main thread destroys and frees vocab after the synchronization lock is released but before the handler finishes using it, causing a crash or potential code execution when --sleep-idle-seconds is configured.

Created: 2026-01-08 Last update: 2026-08-11 05:00

9 security issues in forky high

There are 9 open security issues in forky.

9 important issues:

CVE-2026-2069: A flaw has been found in ggml-org llama.cpp up to 55abc39. Impacted is the function llama_grammar_advance_stack of the file llama.cpp/src/llama-grammar.cpp of the component GBNF Grammar Handler. This manipulation causes stack-based buffer overflow. The attack needs to be launched locally. The exploit has been published and may be used. Patch name: 18993. To fix this issue, it is recommended to deploy a patch.
CVE-2026-17500: A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function _visit_pattern of the file common/json-schema-to-grammar.cpp. The manipulation results in null pointer dereference. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.
CVE-2026-17501: A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.
CVE-2026-18581: A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input {{9|9|{ can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-43627: llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries.
CVE-2026-43628: llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the /v1/completions or /v1/chat/completions endpoints. Attackers can exploit this vulnerability to crash the server with SIGSEGV causing denial of service for all connected users, or corrupt token sampling probabilities by reading garbage values from memory before the allocated buffer.
CVE-2026-43629: llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_data() function computes write size without overflow checking, allowing attackers with write access to the slot_save_path directory to corrupt heap memory. Attackers can craft malicious state files where cell_count multiplication overflows or exceeds tensor buffer allocation to write attacker-controlled bytes past buffer boundaries, potentially resulting in heap metadata corruption, model weight corruption, or arbitrary code execution via function pointer overwrite.
CVE-2026-43631: llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary code. Attackers can trigger the vulnerability by sending requests to affected endpoints while the server transitions to sleep mode, causing concurrent worker threads to dereference a freed vocab pointer that can be reclaimed with attacker-controlled data to achieve remote code execution.
CVE-2026-43632: llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens) that bypass the task queue and access ctx_server.vocab directly on HTTP worker threads. Attackers can exploit a time-of-check-time-of-use race condition where the main thread destroys and frees vocab after the synchronization lock is released but before the handler finishes using it, causing a crash or potential code execution when --sleep-idle-seconds is configured.

Created: 2026-04-13 Last update: 2026-08-11 05:00

lintian reports 10 warnings normal

Lintian reports 10 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-08-06 Last update: 2026-08-06 16:18

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2026-06-01 Last update: 2026-06-01 12:30

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-08-11] Accepted llama.cpp 10344+dfsg-1 (source) into unstable (Christian Kastner)
[2026-08-11] llama.cpp 10271+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-08-05] Accepted llama.cpp 10271+dfsg-1 (source) into unstable (Christian Kastner)
[2026-08-05] llama.cpp 10192+dfsg-2 MIGRATED to testing (Debian testing watch)
[2026-07-31] Accepted llama.cpp 10192+dfsg-2 (source) into unstable (Christian Kastner)
[2026-07-31] Accepted llama.cpp 10192+dfsg-2~exp1 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Christian Kastner)
[2026-07-31] Accepted llama.cpp 10192+dfsg-1 (source) into unstable (Christian Kastner)
[2026-07-30] llama.cpp 10108+dfsg1-2 MIGRATED to testing (Debian testing watch)
[2026-07-26] Accepted llama.cpp 10108+dfsg1-2 (source) into unstable (Christian Kastner)
[2026-07-25] Accepted llama.cpp 10108+dfsg1-1 (source) into unstable (Christian Kastner)
[2026-07-24] Accepted llama.cpp 10108+dfsg-1 (source) into unstable (Christian Kastner)
[2026-07-18] llama.cpp 9951+dfsg-3 MIGRATED to testing (Debian testing watch)
[2026-07-15] Accepted llama.cpp 9951+dfsg-3 (source) into unstable (Mathieu Baudier) (signed by: Christian Kastner)
[2026-07-14] Accepted llama.cpp 9951+dfsg-2 (source) into unstable (Christian Kastner)
[2026-07-14] llama.cpp 9951+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-07-10] Accepted llama.cpp 9951+dfsg-1 (source) into unstable (Christian Kastner)
[2026-07-08] Accepted llama.cpp 9895+dfsg-3 (source) into unstable (Christian Kastner)
[2026-07-08] Accepted llama.cpp 9895+dfsg-2 (source) into unstable (Christian Kastner)
[2026-07-07] Accepted llama.cpp 9895+dfsg-1 (source) into unstable (Christian Kastner)
[2026-06-26] llama.cpp 9721+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-06-23] Accepted llama.cpp 9721+dfsg-1 (source) into unstable (Christian Kastner)
[2026-06-11] Accepted llama.cpp 9601+dfsg-1 (source) into unstable (Christian Kastner)
[2026-06-08] Accepted llama.cpp 9555+dfsg-1 (source) into unstable (Christian Kastner)
[2026-06-05] llama.cpp 9413+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-05-31] Accepted llama.cpp 9413+dfsg-1 (source) into unstable (Christian Kastner)
[2026-05-26] Accepted llama.cpp 9190+dfsg-1 (source) into unstable (Christian Kastner)
[2026-05-08] Accepted llama.cpp 9071+dfsg-1 (source) into unstable (Christian Kastner)
[2026-05-03] Accepted llama.cpp 9009+dfsg-1 (source) into unstable (Christian Kastner)
[2026-04-30] llama.cpp 8941+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-04-27] llama.cpp 8870+dfsg-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 3
RC: 0
I&N: 3
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 10)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (100, -)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 9721+dfsg-1ubuntu1
patches for 9721+dfsg-1ubuntu1