CVE-2025-66960: Ollama DoS Vulnerability in GGUF Parser

CVE-2025-66960 Overview

A denial of service vulnerability exists in Ollama v.0.12.10 that allows a remote attacker to crash the application by exploiting improper input validation in the GGUF metadata parsing functionality. The vulnerability is located in fs/ggml/gguf.go, specifically within the readGGUFV1String function, which reads a string length value from untrusted GGUF metadata without proper validation. This improper input validation (CWE-20) can be leveraged by attackers to trigger a panic condition, resulting in application termination.

Critical Impact

Remote attackers can exploit this vulnerability to cause denial of service by supplying maliciously crafted GGUF model files with manipulated string length values, potentially disrupting AI/ML inference services.

Affected Products

• Ollama v.0.12.10
• GGUF model processing functionality in affected versions

Discovery Timeline

• 2026-01-21 - CVE CVE-2025-66960 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2025-66960

Vulnerability Analysis

The vulnerability stems from insufficient input validation when parsing GGUF (GPT-Generated Unified Format) model files. GGUF is a binary file format used for storing large language models optimized for inference. The readGGUFV1String function in Ollama's GGUF parsing implementation reads string length values directly from the GGUF metadata header without properly validating that these values fall within acceptable bounds.

When a maliciously crafted GGUF file contains an abnormally large or negative string length value in its metadata, the function attempts to allocate memory or read data based on this untrusted value. This can lead to a Go panic condition due to out-of-bounds memory access or failed memory allocation, causing the entire Ollama service to crash.

The vulnerability is particularly concerning for AI/ML deployment environments where Ollama serves as an inference engine, as successful exploitation can disrupt model serving capabilities for all users of the affected instance.

Root Cause

The root cause is improper input validation (CWE-20) in the GGUF file parsing logic. The readGGUFV1String function trusts the string length value embedded in the GGUF metadata without performing boundary checks or sanity validation. This allows an attacker-controlled value to influence memory operations, leading to application instability.

The function should validate that:

1. String length values are within reasonable bounds
2. The length does not exceed the remaining file size
3. Negative or excessively large values are rejected before use

Attack Vector

The attack can be executed remotely over the network by supplying a maliciously crafted GGUF model file to an Ollama instance. Attack scenarios include:

1. Direct Model Upload: Uploading a malicious GGUF file through Ollama's model management interface
2. Model Pull from Untrusted Sources: Tricking users into pulling malicious models from attacker-controlled repositories
3. API Exploitation: Submitting malicious model data through exposed API endpoints

The vulnerability manifests in the GGUF V1 string parsing routine where untrusted metadata values are used directly in memory operations. When the readGGUFV1String function encounters a manipulated string length field, it triggers a panic condition that crashes the service. For detailed technical analysis, see the Zero Learning Blog CVE-2025-66960 Analysis.

Detection Methods for CVE-2025-66960

Indicators of Compromise

• Unexpected Ollama service crashes or restarts without apparent cause
• Go panic stack traces referencing readGGUFV1String or fs/ggml/gguf.go in application logs
• Unusual GGUF file uploads or model pull requests from untrusted sources
• High volume of failed model loading attempts

Detection Strategies

• Monitor Ollama process stability for unexpected terminations or panic conditions
• Implement log analysis rules to detect panic messages containing readGGUFV1String or GGUF-related errors
• Deploy file integrity monitoring on model storage directories to detect suspicious GGUF files
• Configure network monitoring to flag unusual model download patterns or sources

Monitoring Recommendations

• Enable verbose logging in Ollama to capture detailed error information during model loading
• Set up automated alerting for Ollama service crashes and unexpected restarts
• Monitor system resource usage during model loading operations for anomalous behavior
• Implement rate limiting on model upload and pull endpoints

How to Mitigate CVE-2025-66960

Immediate Actions Required

• Restrict access to Ollama model upload functionality to trusted administrators only
• Implement network segmentation to limit exposure of Ollama instances to untrusted networks
• Only load GGUF models from verified and trusted sources
• Monitor Ollama instances for unexpected crashes and investigate any service disruptions

Patch Information

Check the GitHub Issue #9820 for the latest information on patches and fixes from the Ollama development team. Users should upgrade to a patched version of Ollama when available. The fix should include proper validation of string length values in the GGUF parsing logic to prevent panic conditions from malformed input.

Workarounds

• Disable or restrict access to model upload endpoints until a patch is applied
• Implement input validation at the network perimeter to filter potentially malicious GGUF files
• Run Ollama in a containerized environment with restart policies to minimize service disruption
• Use a reverse proxy to rate-limit and filter model-related API requests

# Example: Restrict Ollama to localhost only until patched
# Edit Ollama configuration or use firewall rules
iptables -A INPUT -p tcp --dport 11434 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 11434 -j DROP