EUVD-2026-46642
GHSA-9hhj-2jwx-r87p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network request to default API endpoints (AV:N/AC:L/PR:N/UI:N) crashes the whole process, so availability-only impact A:H with no confidentiality or integrity effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata array counts that are used as allocation sizes without validation against remaining file size. Attackers can upload a sub-1KB crafted GGUF file via the blob upload and model create or pull API endpoints to trigger unrecoverable Go runtime out-of-memory fatal errors or makeslice panics that bypass recovery middleware and crash the entire server process.
AnalysisAI
Remote denial of service in Ollama (HEAD f0078ae) allows unauthenticated attackers to crash the entire server by uploading a sub-1KB crafted GGUF file whose attacker-controlled string lengths, tensor dimension counts, and metadata array counts are trusted as allocation sizes without bounds checking against the remaining file size. Reachable through the blob upload plus model create/pull API endpoints, the flaw triggers unrecoverable Go runtime out-of-memory fatal errors or makeslice panics that bypass the server's recovery middleware, taking down the whole process rather than a single request. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but a vendor patch is available and VulnCheck has published an advisory.
Technical ContextAI
GGUF is the binary tensor/metadata container format used by llama.cpp-derived runtimes (including Ollama) to store quantized model weights and key/value metadata. When parsing GGUF headers, Ollama reads length and count fields - string lengths, tensor dimension counts, and metadata array element counts - and uses them directly to size Go slice allocations. This maps to CWE-789 (Memory Allocation with Excessive Size Value / uncontrolled memory allocation): the parser never validates that a declared length or count is plausible relative to the bytes actually remaining in the file, so a tiny file can declare enormous structures. In Go, an oversized make() either triggers a runtime out-of-memory fatal error or a makeslice bounds panic; unlike ordinary panics, an OOM fatal error and certain makeslice failures are not caught by deferred recover() handlers, so the HTTP recovery middleware cannot contain them and the process dies. The affected CPE is cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*, i.e. the Ollama server application itself.
RemediationAI
Patch available per vendor advisory: upgrade Ollama to the fixed build referenced from the project repository at https://github.com/ollama/ollama and issue https://github.com/ollama/ollama/issues/17042 (consult the linked release/commit for the exact patched version, as no specific fix version is provided in the source data); VulnCheck's advisory at https://www.vulncheck.com/advisories/ollama-remote-denial-of-service-via-attacker-controlled-allocation-in-gguf-metadata-parser tracks the details. Until patched, the highest-value compensating control is to remove untrusted access to the API: bind the Ollama server to localhost (OLLAMA_HOST=127.0.0.1) or place it behind a reverse proxy or firewall that restricts the blob upload and model create/pull endpoints to trusted, authenticated callers, accepting the trade-off that remote clients and automated model-pull workflows will lose direct access. Additionally avoid exposing model create/pull to user-supplied GGUF sources, and monitor for unexpected process restarts as a detection signal, recognizing these controls reduce but do not eliminate exposure for shared or multi-tenant deployments.
Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path,
Denial of service in Ollama's multi-modal image processing (versions 0.11.5-rc0 through 0.13.5) lets remote attackers cr
An issue was discovered in Ollama before 0.1.46. Rated high severity (CVSS 8.2), this vulnerability is remotely exploita
A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by
A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to upload and create a customized GGUF model
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function rea
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder [CVSS 7.5 HIGH]
A divide by zero vulnerability exists in ollama/ollama version v0.3.3. Rated high severity (CVSS 7.5), this vulnerabilit
A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to create a customized GGUF model file that,
A vulnerability in Ollama versions <=0.3.14 allows a malicious user to create a customized gguf model file that can be u
An issue was discovered in Ollama before 0.1.46. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
An issue was discovered in Ollama before 0.1.34. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today