CVE-2026-43631 Exploit Metadata

PoC files

10 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

GitHub

CVE-2026-43631

Created 2026-05-19Vuln labCVE-2026-43631Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud · 2026-08-12

Environment assessment

A Docker-based lab for CVE-2026-43631, a use-after-free vulnerability in llama.cpp's llama-server. The Dockerfile builds a patched (control) version of the server with AddressSanitizer, using a minimal GGUF model, to demonstrate that the community patch prevents the race condition.

CVE-2026-43631/Dockerfile.patched:1-48CVE-2026-43631/README.md:1-74

Lab assessment

Vulnerability lab

The README explicitly describes a vulnerability (CVE-2026-43631), provides a summary, attack chain, and lab run instructions. The Dockerfile builds a patched control server to test the fix, and the PoC script targets the vulnerability. This is a vulnerability research and reproduction environment.

CVE-2026-43631/README.md:1-74CVE-2026-43631/poc/poc.py:1-155

Lab shapeDockerfile

ServicesUnknown

Compose manifests0

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

llama-server (patched control)

target applicationcontrol build

The llama-server built from source with the community patch applied. It is compiled with AddressSanitizer and runs with --sleep-idle-seconds 1, serving a minimal GGUF model on port 8080. The patch adds an n_active_requests counter to prevent the main loop from entering sleep while requests are in-flight, closing the race window.

CVE-2026-43631/Dockerfile.patched:1-48CVE-2026-43631/CVE-2026-43631-server-sleep-uaf.patch:1-115

minimal GGUF model

model fileserver dependency

A tiny GGUF model created by create_minimal_model.py to allow llama-server to start and serve HTTP requests without requiring a real model. It uses minimal dimensions and random tensor data.

CVE-2026-43631/create_minimal_model.py:1-94CVE-2026-43631/Dockerfile.patched:27-28

PoC script

exploit triggertest harness

A Python script that attempts to trigger the use-after-free by sending timed concurrent HTTP requests to the server during the sleep transition window. It checks for server crash to confirm vulnerability.

CVE-2026-43631/poc/poc.py:1-155

community patch

fixcontrol mechanism

A unified diff that applies the community fix to the server source code. It introduces an atomic counter to track active requests and gates the sleep entry on that counter being zero, preventing the race condition.

CVE-2026-43631/CVE-2026-43631-server-sleep-uaf.patch:1-115

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-43631

Supported by supplied evidence

The README, PoC script, and verification report all describe a use-after-free in llama-server's sleep-idle feature. The Dockerfile builds a patched control to demonstrate the fix. The evidence consistently associates this CVE with the described vulnerability.

CVE-2026-43631/README.md:1-74CVE-2026-43631/poc/poc.py:1-155CVE-2026-43631/poc_verification_report.md:1-29

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker must be installed to build and run the container.CVE-2026-43631/README.md:56-58
The server must be started with --sleep-idle-seconds set to a positive value (1 second in the lab).CVE-2026-43631/Dockerfile.patched:43-48
The PoC requires Python 3 and network access to the target server.CVE-2026-43631/poc/poc.py:1-155

Evidence-described exercise path

Build the patched control Docker image using Dockerfile.patched.CVE-2026-43631/README.md:64-65
Run the control container, mapping host port 8081 to container port 8080.CVE-2026-43631/README.md:66
Wait 3 seconds for the server to settle.CVE-2026-43631/README.md:67
Run the PoC script against the control server (127.0.0.1:8081) with sleep_seconds=1 and max_attempts=20.CVE-2026-43631/README.md:68
Observe that the server survives all attempts (PoC reports [FAILED]), confirming the patch prevents the race.CVE-2026-43631/README.md:70

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile builds a patched control server inside a container. The PoC script sends HTTP requests to trigger a crash, which is the expected behavior for a vulnerability lab. There is no evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the intended target crash.

CVE-2026-43631/Dockerfile.patched:1-48CVE-2026-43631/poc/poc.py:1-155

Review boundaries

What the analysis did not establish

The packet includes only the patched Dockerfile; the vulnerable Dockerfile (Dockerfile.vulnerable) is mentioned in the file inventory but its content is not provided, limiting full comparison.
The docker-compose.yml file is listed in the inventory but its content is not included, so the compose-based lab run instructions cannot be fully verified.
The PoC script is designed to crash the server, which is expected in a vulnerability lab, but the analysis cannot confirm whether the crash could be exploited for code execution beyond the lab scope.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

CVE-2026-43631/docker-compose.yml

Created 2026-05-19Vuln labCVE-2026-43631Compose · mixed

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud · 2026-08-12

Environment assessment

A containerized vulnerability-research lab for CVE-2026-43631, a use-after-free race condition in llama.cpp's llama-server. The lab builds a vulnerable ASAN-instrumented server from a pinned commit, loads a minimal GGUF model, and exposes the server on a configurable port. A PoC script triggers the race by sending timed concurrent HTTP requests.

CVE-2026-43631/README.md:1-74CVE-2026-43631/docker-compose.yml:1-22CVE-2026-43631/Dockerfile.vulnerable:1-43

Lab assessment

Vulnerability lab

The README explicitly describes a vulnerability (CVE-2026-43631), provides a summary, attack chain, and lab run instructions. The Dockerfile builds a vulnerable server with AddressSanitizer, and the compose file starts it with the vulnerable --sleep-idle-seconds flag. A PoC script is included to trigger the UAF.

CVE-2026-43631/README.md:1-74CVE-2026-43631/Dockerfile.vulnerable:1-43CVE-2026-43631/docker-compose.yml:1-22

Lab shapeCompose · mixed

Services1

Compose manifests1

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

target (llama-server)

vulnerable target server

A single service built from Dockerfile.vulnerable. It runs llama-server compiled with AddressSanitizer, loads a minimal GGUF model, and listens on port 8080 with --sleep-idle-seconds 1. The healthcheck uses netcat to verify the port is open.

CVE-2026-43631/docker-compose.yml:2-22CVE-2026-43631/Dockerfile.vulnerable:1-43

create_minimal_model.py

model generator

A Python script copied into the build that creates a minimal GGUF model file (/src/tiny-model.gguf) with tiny dimensions and random tensor data, sufficient for llama-server to start and serve HTTP requests.

CVE-2026-43631/Dockerfile.vulnerable:20-21CVE-2026-43631/create_minimal_model.py:1-94

poc.py

proof-of-concept exploit

A Python script that triggers the UAF by sending a warmup request, waiting near the sleep-idle threshold, then sending 16 concurrent HTTP requests (mixing /tokenize and /v1/chat/completions) with large bodies to maximize the race window. It checks for server crash to confirm success.

CVE-2026-43631/poc/poc.py:1-155

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-43631

Supported by supplied evidence

The lab is explicitly built around CVE-2026-43631. The README describes the vulnerability, the Dockerfile builds a vulnerable version, the compose file enables the vulnerable --sleep-idle-seconds flag, and the PoC script targets the described race condition. The verification report confirms successful reproduction.

CVE-2026-43631/README.md:1-74CVE-2026-43631/docker-compose.yml:8-13CVE-2026-43631/poc/poc.py:1-155CVE-2026-43631/poc_verification_report.md:1-29

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker and Docker Compose installed on the host.CVE-2026-43631/README.md:56-58
Python 3 with urllib available on the host to run the PoC.CVE-2026-43631/README.md:62-63
The vulnerable server must be running with --sleep-idle-seconds set to a positive value (default 1 in compose).CVE-2026-43631/docker-compose.yml:8-13

Evidence-described exercise path

Build the vulnerable ASAN-instrumented server image using 'docker compose build'.CVE-2026-43631/README.md:57-58
Start the vulnerable server in detached mode with 'docker compose up -d'.CVE-2026-43631/README.md:60-61
Wait a few seconds for the server to settle, then run the PoC script: 'python3 poc/poc.py 127.0.0.1 8080 1 5'.CVE-2026-43631/README.md:62-63
Observe the server crash (ASAN DEADLYSIGNAL) and the PoC output '[SUCCESS]'.CVE-2026-43631/README.md:64

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own vulnerable target container. The PoC sends HTTP requests to the container's llama-server to trigger a use-after-free crash, which is the documented vulnerability exercise. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior beyond the intended lab target.

CVE-2026-43631/poc/poc.py:1-155CVE-2026-43631/docker-compose.yml:1-22CVE-2026-43631/Dockerfile.vulnerable:1-43

Review boundaries

What the analysis did not establish

The patch file (CVE-2026-43631-server-sleep-uaf.patch) and Dockerfile.patched are referenced but not included in the evidence packet; their contents cannot be inspected.
The verification report references artifact files (poc_run.txt, cold_cycles.txt, control_run.txt, asan-crash-log.txt, docker_logs.txt) that are not included in the evidence packet.
The compose file uses a variable LAB_PORT with a default, but no .env file is provided; the actual port mapping depends on the host environment.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

CVE-2026-43631