llama.cpp - Debian Package Tracker

general

source: llama.cpp (main)
version: 1:0.4.1+dfsg-1
maintainer: Debian Deep Learning Team (archive) (DMD)
uploaders: Christian Kastner [DMD] – Mathieu Baudier [DMD]
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

testing: 1:0.4.1+dfsg-1
unstable: 1:0.4.1+dfsg-1

versioned links

1:0.4.1+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libllama-dev
libllama0
llama.cpp (1 bugs: 0, 1, 0, 0)
llama.cpp-examples
llama.cpp-services
llama.cpp-tests
llama.cpp-tools
llama.cpp-tools-extra
python3-gguf

action needed

Marked for autoremoval on 13 October due to docker.io, go-containerregistry, golang-github-aws-aws-sdk-go, golang-github-azure-azure-sdk-for-go, golang-github-azure-go-autorest, golang-github-frankban-quicktest, golang-github-go-quicktest-qt, golang-github-google-go-github, golang-github-googleapis-gax-go, golang-github-gorilla-handlers, golang-github-peterbourgon-diskv, golang-k8s-apimachinery, golang-pgregory-rapid, python-memray, sphinxcontrib-log-cabinet: #1146178, #1146179, #1146183, #1146184, #1146185, #1146192, #1146197, #1146199, #1146200, #1146201, #1146207, #1146219, #1146223, #1146575, #1147863 high

Version 1:0.4.1+dfsg-1 of llama.cpp is marked for autoremoval from testing on Tue 13 Oct 2026. It depends (transitively) on docker.io, go-containerregistry, golang-github-aws-aws-sdk-go, golang-github-azure-azure-sdk-for-go, golang-github-azure-go-autorest, golang-github-frankban-quicktest, golang-github-go-quicktest-qt, golang-github-google-go-github, golang-github-googleapis-gax-go, golang-github-gorilla-handlers, golang-github-peterbourgon-diskv, golang-k8s-apimachinery, golang-pgregory-rapid, python-memray, sphinxcontrib-log-cabinet, affected by #1146178, #1146179, #1146183, #1146184, #1146185, #1146192, #1146197, #1146199, #1146200, #1146201, #1146207, #1146219, #1146223, #1146575, #1147863. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-08-01 Last update: 2026-09-23 04:17

15 security issues in sid high

There are 15 open security issues in sid.

15 important issues:

CVE-2026-2069: A flaw has been found in ggml-org llama.cpp up to 55abc39. Impacted is the function llama_grammar_advance_stack of the file llama.cpp/src/llama-grammar.cpp of the component GBNF Grammar Handler. This manipulation causes stack-based buffer overflow. The attack needs to be launched locally. The exploit has been published and may be used. Patch name: 18993. To fix this issue, it is recommended to deploy a patch.
CVE-2026-17500: A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function _visit_pattern of the file common/json-schema-to-grammar.cpp. The manipulation results in null pointer dereference. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.
CVE-2026-17501: A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.
CVE-2026-18581: A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input {{9|9|{ can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-43627: llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries.
CVE-2026-43628: llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the /v1/completions or /v1/chat/completions endpoints. Attackers can exploit this vulnerability to crash the server with SIGSEGV causing denial of service for all connected users, or corrupt token sampling probabilities by reading garbage values from memory before the allocated buffer.
CVE-2026-43629: llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_data() function computes write size without overflow checking, allowing attackers with write access to the slot_save_path directory to corrupt heap memory. Attackers can craft malicious state files where cell_count multiplication overflows or exceeds tensor buffer allocation to write attacker-controlled bytes past buffer boundaries, potentially resulting in heap metadata corruption, model weight corruption, or arbitrary code execution via function pointer overwrite.
CVE-2026-43631: llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary code. Attackers can trigger the vulnerability by sending requests to affected endpoints while the server transitions to sleep mode, causing concurrent worker threads to dereference a freed vocab pointer that can be reclaimed with attacker-controlled data to achieve remote code execution.
CVE-2026-43632: llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens) that bypass the task queue and access ctx_server.vocab directly on HTTP worker threads. Attackers can exploit a time-of-check-time-of-use race condition where the main thread destroys and frees vocab after the synchronization lock is released but before the handler finishes using it, causing a crash or potential code execution when --sleep-idle-seconds is configured.
CVE-2026-52130: llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service.
CVE-2026-52131: llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function.
CVE-2026-52132: llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service (std::bad_alloc and HTTP 500) via a negative top_n value in a POST request to /rerank.
CVE-2026-78147: A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Performing a manipulation of the argument op/op_params results in deserialization. The attack may be initiated remotely. This vulnerability is distinct from CVE-2026-34159 (GHSA-j8rj-fmpv-wcxw, PR #20908), which only added a buffer==nullptr rejection in create_node() and does not validate op or op_params. The reported GitHub issue was closed automatically due to inactivity.
CVE-2026-78148: A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.
CVE-2026-86317: A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpc_server::deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component RPC Server. Performing a manipulation of the argument ne results in reachable assertion. The attack is possible to be carried out remotely. The reported GitHub issue was closed automatically due to inactivity.

Created: 2026-01-08 Last update: 2026-09-17 03:30

15 security issues in forky high

There are 15 open security issues in forky.

15 important issues:

CVE-2026-2069: A flaw has been found in ggml-org llama.cpp up to 55abc39. Impacted is the function llama_grammar_advance_stack of the file llama.cpp/src/llama-grammar.cpp of the component GBNF Grammar Handler. This manipulation causes stack-based buffer overflow. The attack needs to be launched locally. The exploit has been published and may be used. Patch name: 18993. To fix this issue, it is recommended to deploy a patch.
CVE-2026-17500: A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function _visit_pattern of the file common/json-schema-to-grammar.cpp. The manipulation results in null pointer dereference. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.
CVE-2026-17501: A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.
CVE-2026-18581: A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input {{9|9|{ can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-43627: llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries.
CVE-2026-43628: llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the /v1/completions or /v1/chat/completions endpoints. Attackers can exploit this vulnerability to crash the server with SIGSEGV causing denial of service for all connected users, or corrupt token sampling probabilities by reading garbage values from memory before the allocated buffer.
CVE-2026-43629: llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_data() function computes write size without overflow checking, allowing attackers with write access to the slot_save_path directory to corrupt heap memory. Attackers can craft malicious state files where cell_count multiplication overflows or exceeds tensor buffer allocation to write attacker-controlled bytes past buffer boundaries, potentially resulting in heap metadata corruption, model weight corruption, or arbitrary code execution via function pointer overwrite.
CVE-2026-43631: llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary code. Attackers can trigger the vulnerability by sending requests to affected endpoints while the server transitions to sleep mode, causing concurrent worker threads to dereference a freed vocab pointer that can be reclaimed with attacker-controlled data to achieve remote code execution.
CVE-2026-43632: llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens) that bypass the task queue and access ctx_server.vocab directly on HTTP worker threads. Attackers can exploit a time-of-check-time-of-use race condition where the main thread destroys and frees vocab after the synchronization lock is released but before the handler finishes using it, causing a crash or potential code execution when --sleep-idle-seconds is configured.
CVE-2026-52130: llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service.
CVE-2026-52131: llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function.
CVE-2026-52132: llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service (std::bad_alloc and HTTP 500) via a negative top_n value in a POST request to /rerank.
CVE-2026-78147: A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Performing a manipulation of the argument op/op_params results in deserialization. The attack may be initiated remotely. This vulnerability is distinct from CVE-2026-34159 (GHSA-j8rj-fmpv-wcxw, PR #20908), which only added a buffer==nullptr rejection in create_node() and does not validate op or op_params. The reported GitHub issue was closed automatically due to inactivity.
CVE-2026-78148: A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.
CVE-2026-86317: A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpc_server::deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component RPC Server. Performing a manipulation of the argument ne results in reachable assertion. The attack is possible to be carried out remotely. The reported GitHub issue was closed automatically due to inactivity.

Created: 2026-04-13 Last update: 2026-09-17 03:30

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2026-09-17 Last update: 2026-09-22 23:48

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 8bae43f316204bc2da14da4d670d36f0f6b5259e
Merge: 2568025 f56e907
Author: Christian Kastner <ckk@kvr.at>
Date:   Tue Sep 22 20:11:15 2026 +0000

    Merge branch 'set-dev-off' into 'debian/unstable'
    
    Switch LLAMA_BUILD_IS_DEV to OFF
    
    See merge request deeplearning-team/llama.cpp!11

commit f56e907d55290ed46e4847d97ad50d08abb80273
Author: Dylan Aïssi <daissi@debian.org>
Date:   Tue Sep 22 17:24:51 2026 +0200

    Switch LLAMA_BUILD_IS_DEV to OFF
    
    This is a new build option which appends a -dev suffix to LLAMA_VERSION.
    Upstream recommends that distributors disable this option when building releases:
    https://github.com/ggml-org/llama.cpp/blob/master/docs/release.md#building-a-release
    
    Signed-off-by: Dylan Aïssi <dylan.aissi@collabora.com>

https://salsa.debian.org/api/v4/projects/deeplearning-team%2Fllama.cpp API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-09-22 Last update: 2026-09-22 22:01

lintian reports 7 warnings normal

Lintian reports 7 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-09-15 Last update: 2026-09-15 13:01

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2026-06-01 Last update: 2026-06-01 12:30

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-09-17] llama.cpp 1:0.4.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-09-14] Accepted llama.cpp 1:0.4.1+dfsg-1 (source) into unstable (Christian Kastner)
[2026-09-14] llama.cpp 1:0.4.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-09-05] Accepted llama.cpp 1:0.4.0+dfsg-1 (source) into unstable (Christian Kastner)
[2026-08-31] llama.cpp 1:0.2.0+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2026-08-23] Accepted llama.cpp 1:0.2.0+dfsg1-1 (source) into unstable (Christian Kastner)
[2026-08-22] Accepted llama.cpp 1:0.2.0+dfsg1-1~exp1 (source) into experimental (Christian Kastner)
[2026-08-20] Accepted llama.cpp 1:0.1.2+dfsg-1~exp1 (source) into experimental (Christian Kastner)
[2026-08-18] Accepted llama.cpp 10438+dfsg-1 (source) into unstable (Mathieu Baudier) (signed by: Christian Kastner)
[2026-08-11] Accepted llama.cpp 10344+dfsg-1 (source) into unstable (Christian Kastner)
[2026-08-11] llama.cpp 10271+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-08-05] Accepted llama.cpp 10271+dfsg-1 (source) into unstable (Christian Kastner)
[2026-08-05] llama.cpp 10192+dfsg-2 MIGRATED to testing (Debian testing watch)
[2026-07-31] Accepted llama.cpp 10192+dfsg-2 (source) into unstable (Christian Kastner)
[2026-07-31] Accepted llama.cpp 10192+dfsg-2~exp1 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Christian Kastner)
[2026-07-31] Accepted llama.cpp 10192+dfsg-1 (source) into unstable (Christian Kastner)
[2026-07-30] llama.cpp 10108+dfsg1-2 MIGRATED to testing (Debian testing watch)
[2026-07-26] Accepted llama.cpp 10108+dfsg1-2 (source) into unstable (Christian Kastner)
[2026-07-25] Accepted llama.cpp 10108+dfsg1-1 (source) into unstable (Christian Kastner)
[2026-07-24] Accepted llama.cpp 10108+dfsg-1 (source) into unstable (Christian Kastner)
[2026-07-18] llama.cpp 9951+dfsg-3 MIGRATED to testing (Debian testing watch)
[2026-07-15] Accepted llama.cpp 9951+dfsg-3 (source) into unstable (Mathieu Baudier) (signed by: Christian Kastner)
[2026-07-14] Accepted llama.cpp 9951+dfsg-2 (source) into unstable (Christian Kastner)
[2026-07-14] llama.cpp 9951+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-07-10] Accepted llama.cpp 9951+dfsg-1 (source) into unstable (Christian Kastner)
[2026-07-08] Accepted llama.cpp 9895+dfsg-3 (source) into unstable (Christian Kastner)
[2026-07-08] Accepted llama.cpp 9895+dfsg-2 (source) into unstable (Christian Kastner)
[2026-07-07] Accepted llama.cpp 9895+dfsg-1 (source) into unstable (Christian Kastner)
[2026-06-26] llama.cpp 9721+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-06-23] Accepted llama.cpp 9721+dfsg-1 (source) into unstable (Christian Kastner)

bugs [bug history graph]

all: 3
RC: 0
I&N: 3
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 7)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (100, -)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 10438+dfsg-1
2 bugs