What is the CVSS score of CVE-2026-15685?

CVE-2026-15685 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Ollama are affected by CVE-2026-15685?

Ollama is vulnerable to a remote denial-of-service attack that allows unauthenticated attackers to crash affected installations without user interaction.

How to fix or mitigate CVE-2026-15685?

Within 24 hours: Audit network architecture to identify any Ollama instances accessible from the internet; implement firewall rules or network segmentation to restrict access to trusted internal networks only. Within 7 days: Deploy network-based monitoring to detect malformed requests to the downloadBlob function; consider implementing rate limiting or request validation at your load balancer or reverse proxy layer. Within 30 days: Monitor Ollama's official security advisories and release notes for patch availability; prepare a testing and deployment plan so you can apply the fix within 48 hours of release.

Ollama CVE-2026-15685

HIGH

Improper Validation of Array Index (CWE-129)

2026-07-13 zdi

Information Disclosure Red Hat Ollama Suse

7.5

CVSS 3.0 · Vendor: zdi

Severity by source

Vendor (zdi) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated low-complexity request over the network (AV:N/AC:L/PR:N/UI:N) crashes the service, so availability-only A:H with C:N/I:N; scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 22:00 vuln.today

CVE Published

Jul 13, 2026 - 21:30 cve.org

HIGH 7.5

DescriptionCVE.org

Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ollama. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the downloadBlob function. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated array. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-27277.

AnalysisAI

Denial-of-service in Ollama's downloadBlob function lets remote, unauthenticated attackers crash affected installations by supplying malformed data that triggers an out-of-bounds array access. The flaw (ZDI-CAN-27277 / ZDI-26-403, CWE-129) carries a CVSS 7.5 with an availability-only impact and requires no authentication or user interaction. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Ollama is a widely used self-hosted runtime for running and serving large language models locally, exposing an HTTP API for model management including blob/model downloads. The vulnerability is rooted in CWE-129 (Improper Validation of Array Index): the downloadBlob function does not properly validate a user-supplied value before using it as an index into an allocated array, permitting a memory access past the end of that array. In Ollama's Go implementation this class of bug typically surfaces as a slice/array bounds violation leading to a runtime panic that terminates the server process, consistent with the availability-only impact in the CVSS vector. The single CPE, cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*, indicates all versions are flagged pending a vendor-confirmed fixed release.

RemediationAI

No vendor-released patch version was identified in the provided data, so upgrade to the latest available Ollama release once the maintainers publish a fixed build and monitor the ZDI advisory ZDI-26-403 (https://www.zerodayinitiative.com/advisories/ZDI-26-403/) and Ollama's release notes for the confirmed fixed version. As compensating controls, ensure the Ollama API is bound only to localhost (its default OLLAMA_HOST of 127.0.0.1) rather than 0.0.0.0, which prevents remote reachability entirely at the cost of blocking legitimate remote clients; where remote access is required, place Ollama behind an authenticating reverse proxy or restrict the listening port (default 11434) via firewall/security-group rules to trusted source addresses only, accepting the added operational overhead. Because the fault is a crash-style DoS, run the service under a supervisor (systemd restart, container restart policy) so it auto-recovers, understanding this reduces downtime but does not stop repeated attacks.