CVE-2026-17501 PUBLISHED

A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes allocation of resources. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.

• m00dy (VulDB User) reporter
• VulDB CNA Team coordinator

• VDB-383354 | ggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform allocation of resources
• VDB-383354 | CTI Indicators (IOB, IOC, TTP, IOA)
• CVE-2026-17501 | CVE Analysis and Report
• Submit #798504 | ggml-org llama.cpp (confirmed on commit e15efe0 / tag b8635+1) Uncontrolled Recursion
• https://github.com/ggml-org/llama.cpp/issues/25283
• https://github.com/ggml-org/llama.cpp/pull/25308
• https://github.com/ggml-org/llama.cpp/

• Allocation of Resources CWE
• Resource Consumption CWE