CVE catalog

CVE-2026-43628

llama.cpp builds b3978 through b9058 contain an…

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the /v1/completions or /v1/chat/completions endpoints. Attackers can exploit this vulnerability to crash the server with SIGSEGV causing denial of service for all connected users, or corrupt token sampling probabilities by reading garbage values from memory before the allocated buffer.

Severity: High · CVSS 8.5CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Aug 6, 2026, 10:17:05 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.23% · Oct 29, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debian14	llama.cpp	`10108+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`10108+dfsg1-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`10108+dfsg1-2`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`10192+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`10192+dfsg-2`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`10192+dfsg-2~exp1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`10271+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`10344+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`10438+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`1:0.1.2+dfsg-1~exp1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`1:0.2.0+dfsg1-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`1:0.2.0+dfsg1-1~exp1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC

Showing 12 observations. All 63 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debian14	llama.cpp	`10108+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`10108+dfsg1-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`10108+dfsg1-2`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`10192+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`10192+dfsg-2`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`10192+dfsg-2~exp1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`10271+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`10344+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`10438+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`1:0.1.2+dfsg-1~exp1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`1:0.2.0+dfsg1-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`1:0.2.0+dfsg1-1~exp1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`1:0.4.0+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`1:0.4.1+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`1:0.5.0+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`1:0.5.0+dfsg-2`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`1:0.6.0+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`1:0.6.0+dfsg-2`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`1:0.7.0+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`1:0.7.0+dfsg-2`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`5151+dfsg-1~exp2`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`5151+dfsg-1~exp3`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`5318+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`5318+dfsg-2`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`5713+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`5760+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`5760+dfsg-2`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`5760+dfsg-3`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`5760+dfsg-4`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`5882+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`5882+dfsg-2`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`5882+dfsg-3`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`5882+dfsg-3~exp1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`5882+dfsg-3~exp2`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`5882+dfsg-3~exp3`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`5882+dfsg-4`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`6641+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`6641+dfsg-2`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`6641+dfsg-3`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`7593+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`7593+dfsg-2`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`7593+dfsg-3`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`7965+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`8064+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`8064+dfsg-2`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`8461+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`8611+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`8681+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`8870+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`8941+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`9009+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`9071+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`9190+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`9413+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`9555+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`9601+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`9721+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`9895+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`9895+dfsg-2`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`9895+dfsg-3`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`9951+dfsg-1`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`9951+dfsg-2`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC
Debian14	llama.cpp	`9951+dfsg-3`	Affected	[DEBIAN-CVE-2026-43628]Oct 24, 2026, 10:01:03 AM UTC

Original provider fields

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "llama.cpp",
      "ranges": [
        {
          "fixed": "",
          "introduced": "b3978",
          "last_affected": "b9058",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43628",
      "fixed_version": "",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-43628",
      "provider_updated_at": "2026-10-23T21:10:00.157"
    },
    {
      "name": "llama.cpp",
      "distro": "debian",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "14",
      "versions": [
        "10108+dfsg-1",
        "10108+dfsg1-1",
        "10108+dfsg1-2",
        "10192+dfsg-1",
        "10192+dfsg-2",
        "10192+dfsg-2~exp1",
        "10271+dfsg-1",
        "10344+dfsg-1",
        "10438+dfsg-1",
        "1:0.1.2+dfsg-1~exp1",
        "1:0.2.0+dfsg1-1",
        "1:0.2.0+dfsg1-1~exp1",
        "1:0.4.0+dfsg-1",
        "1:0.4.1+dfsg-1",
        "1:0.5.0+dfsg-1",
        "1:0.5.0+dfsg-2",
        "1:0.6.0+dfsg-1",
        "1:0.6.0+dfsg-2",
        "1:0.7.0+dfsg-1",
        "1:0.7.0+dfsg-2",
        "5151+dfsg-1~exp2",
        "5151+dfsg-1~exp3",
        "5318+dfsg-1",
        "5318+dfsg-2",
        "5713+dfsg-1",
        "5760+dfsg-1",
        "5760+dfsg-2",
        "5760+dfsg-3",
        "5760+dfsg-4",
        "5882+dfsg-1",
        "5882+dfsg-2",
        "5882+dfsg-3",
        "5882+dfsg-3~exp1",
        "5882+dfsg-3~exp2",
        "5882+dfsg-3~exp3",
        "5882+dfsg-4",
        "6641+dfsg-1",
        "6641+dfsg-2",
        "6641+dfsg-3",
        "7593+dfsg-1",
        "7593+dfsg-2",
        "7593+dfsg-3",
        "7965+dfsg-1",
        "8064+dfsg-1",
        "8064+dfsg-2",
        "8461+dfsg-1",
        "8611+dfsg-1",
        "8681+dfsg-1",
        "8870+dfsg-1",
        "8941+dfsg-1",
        "9009+dfsg-1",
        "9071+dfsg-1",
        "9190+dfsg-1",
        "9413+dfsg-1",
        "9555+dfsg-1",
        "9601+dfsg-1",
        "9721+dfsg-1",
        "9895+dfsg-1",
        "9895+dfsg-2",
        "9895+dfsg-3",
        "9951+dfsg-1",
        "9951+dfsg-2",
        "9951+dfsg-3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-43628",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "DEBIAN-CVE-2026-43628",
      "provider_updated_at": "2026-10-24T10:01:03.240098773Z"
    }
  ]
}

OpenFactory catalog packages

No matching packages in this catalog.

Observed: Oct 29, 2026, 10:13:14 AM UTC

References

[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]