CVE-2026-15685 Overview
CVE-2026-15685 is an improper array index validation vulnerability [CWE-129] in the downloadBlob function of Ollama, an open-source large language model runtime. Remote attackers can trigger a denial-of-service condition without authentication. The flaw allows memory access past the end of an allocated array when user-supplied data is not properly validated. The Zero Day Initiative tracks this issue as ZDI-CAN-27277 and published advisory ZDI-26-403.
Critical Impact
Unauthenticated remote attackers can crash Ollama instances over the network, disrupting availability of hosted language model services.
Affected Products
- Ollama version 0.7.1
- Deployments exposing the Ollama API over the network
- Self-hosted LLM services built on affected Ollama releases
Discovery Timeline
- 2026-07-13 - CVE-2026-15685 published to the National Vulnerability Database
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-15685
Vulnerability Analysis
The vulnerability resides in the downloadBlob function, which handles blob retrieval during model download operations. Ollama fails to validate an array index derived from attacker-controlled input. The resulting out-of-bounds memory access forces the process to terminate, halting service. Because Ollama frequently runs as a long-lived local or networked inference service, a single crafted request removes the model runtime from availability.
Root Cause
The root cause is an improper validation of an array index [CWE-129] within downloadBlob. User-supplied data flows into an indexing operation without bounds enforcement. When the index exceeds the allocated array length, the Go runtime aborts on the invalid memory access. No memory disclosure or code execution has been reported for this issue, consistent with the availability-only impact recorded in the CVSS vector.
Attack Vector
Exploitation occurs over the network and requires no authentication or user interaction. An attacker sends a crafted request that reaches the vulnerable downloadBlob code path. The Ollama process crashes on the out-of-bounds access, ending inference sessions and blocking new model pulls. Attackers can repeat the request to sustain the denial-of-service condition against restarted instances.
No public proof-of-concept exploit code is currently available. Technical details are documented in the Zero Day Initiative Advisory ZDI-26-403.
Detection Methods for CVE-2026-15685
Indicators of Compromise
- Unexpected termination of the ollama process with runtime panic messages referencing index out of range in downloadBlob.
- Repeated inbound requests to Ollama blob or model pull endpoints from a single remote source preceding a crash.
- Loss of availability on the Ollama API port (default 11434) followed by service restart events.
Detection Strategies
- Monitor Ollama server logs and system journals for Go runtime panics originating in blob download handling.
- Correlate HTTP request logs at reverse proxies fronting Ollama with process restart timestamps to identify triggering payloads.
- Alert on abnormal frequencies of model pull or blob download requests from external sources.
Monitoring Recommendations
- Enable process health monitoring for the Ollama service and track restart counts as a stability metric.
- Capture network traffic to the Ollama API for forensic review when crashes occur.
- Track Ollama version inventory across hosts to identify systems still running vulnerable releases.
How to Mitigate CVE-2026-15685
Immediate Actions Required
- Restrict network access to the Ollama API so only trusted clients can reach the service.
- Place Ollama behind an authenticating reverse proxy that filters malformed blob download requests.
- Update to a patched Ollama release once the vendor publishes a fix addressing the downloadBlob validation flaw.
Patch Information
No vendor patch reference is included in the current advisory data. Administrators should monitor the Ollama project releases and the Zero Day Initiative Advisory ZDI-26-403 for remediation guidance and version details.
Workarounds
- Bind the Ollama service to localhost or an internal interface instead of 0.0.0.0 where remote access is unnecessary.
- Enforce network-layer allow lists at the host firewall or cloud security group to limit exposure of TCP port 11434.
- Deploy a process supervisor to automatically restart Ollama after crashes while investigating suspicious traffic sources.
# Configuration example: bind Ollama to localhost only
export OLLAMA_HOST=127.0.0.1:11434
systemctl restart ollama
# Restrict inbound access at the host firewall (Linux nftables)
nft add rule inet filter input tcp dport 11434 ip saddr != 10.0.0.0/24 drop
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
