Use-After-Free Vulnerability in llama-server

CVE-2026-43632 is a use-after-free vulnerability affecting llama-server builds b7492 through b9060. The vulnerability resides in the handling of six specific tokenization-related endpoints: /tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens. These endpoints bypass the standard task queue and access the 'ctx_server.vocab' memory structure directly from HTTP worker threads.

The issue stems from a time-of-check-time-of-use (TOCTOU) race condition. When the application is configured with the '--sleep-idle-seconds' flag, the main thread can destroy and free the vocabulary memory after the synchronization lock is released but before the HTTP worker thread has finished utilizing the reference. This leads to memory corruption, service crashes, or potential remote code execution if an attacker can reliably trigger the race condition while the server is transitioning into an idle state.

Impact

Successful exploitation of this vulnerability leads to denial-of-service via application crashes or potential remote code execution on the server hosting the llama-server instance. Given the prevalence of local LLM deployment, this represents a significant risk for organizations using llama-server as a backend component for AI-integrated services or private infrastructure, particularly when exposed to untrusted network traffic.

Recommendation

• Update llama.cpp to a build version later than b9060 to mitigate CVE-2026-43632.
• Monitor access logs for sustained, high-frequency requests to the identified tokenization endpoints, as these may indicate attempts to win the race condition.
• Disable the '--sleep-idle-seconds' configuration flag in production environments until a patched build is deployed to eliminate the triggering condition for the race.