CVE-2026-65315: Ollama GGUF Parser DoS Vulnerability

CVE-2026-65315 Overview

CVE-2026-65315 is an uncontrolled memory allocation vulnerability [CWE-789] in the GGUF metadata parser of Ollama at commit HEAD f0078ae. Remote attackers can supply a crafted GGUF file with malicious length and count fields in string lengths, tensor dimension counts, and metadata array counts. The parser uses these attacker-controlled values as allocation sizes without validating them against the remaining file size. A sub-1KB crafted GGUF file uploaded through the blob upload and model create or pull API endpoints triggers unrecoverable Go runtime out-of-memory fatal errors or makeslice panics. These errors bypass recovery middleware and crash the entire Ollama server process.

Critical Impact
A single crafted request under 1KB can crash the Ollama server, producing a remote denial-of-service condition against exposed inference endpoints.

Affected Products

Ollama at commit HEAD f0078ae
Ollama deployments exposing the blob upload API endpoint
Ollama deployments exposing the model create or pull API endpoints

Discovery Timeline

2026-07-21 - CVE-2026-65315 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-65315

Vulnerability Analysis

The vulnerability resides in Ollama's GGUF metadata parser. GGUF is the binary container format used to package model weights and metadata for local large language model inference. When Ollama parses a GGUF file, it reads several length and count fields directly from the file header, including string lengths, tensor dimension counts, and metadata array counts. The parser passes these values to Go slice allocation routines without cross-checking them against the actual remaining file size.

An attacker who can reach the HTTP API can upload a crafted file smaller than 1KB that declares multi-gigabyte allocation sizes. The Go runtime then attempts to allocate a slice larger than available memory, producing a runtime: out of memory fatal error or a makeslice: len out of range panic. Both conditions terminate the process before the HTTP server's recover middleware can intercept them.

Root Cause

The root cause is missing validation between untrusted length or count fields and the size of the input file. The parser trusts declared lengths as authoritative and performs allocations before sanity-checking them, which violates the [CWE-789] pattern of validating input size before allocation.

Attack Vector

Exploitation requires no authentication when Ollama is exposed on the network. The attacker sends a small crafted GGUF blob to the blob upload endpoint, then references it through the model create or pull API. The parser is invoked during model import, at which point the malicious length fields drive the fatal allocation. Because the fault is a Go runtime fatal error rather than a recoverable panic, the entire server process exits and terminates all active inference sessions. Technical details are documented in the Vulncheck Security Advisory and GitHub Issue #17042.

Detection Methods for CVE-2026-65315

Indicators of Compromise

Ollama process termination correlated with recent requests to /api/blobs/, /api/create, or /api/pull endpoints.
Server logs containing runtime: out of memory, fatal error: runtime, or makeslice: len out of range messages.
Small GGUF uploads (under 1KB) followed immediately by a model create or pull API call from the same source.
Repeated Ollama service restarts by supervisors such as systemd or container orchestrators without corresponding administrative activity.

Detection Strategies

Inspect HTTP request bodies to the blob upload endpoint for GGUF magic bytes combined with anomalously large declared string, tensor, or array counts relative to payload size.
Alert on Go runtime fatal error signatures in Ollama stderr output ingested by log aggregation pipelines.
Correlate Ollama process exit events with the last received API request to attribute crashes to a specific client.

Monitoring Recommendations

Track process uptime and restart counts for Ollama instances, especially those reachable from untrusted networks.
Monitor memory allocation spikes on hosts running Ollama and flag sudden growth followed by process exit.
Log all requests to /api/create, /api/pull, and /api/blobs/ with source IP, size, and response code for post-incident review.

How to Mitigate CVE-2026-65315

Immediate Actions Required

Restrict network access to Ollama API endpoints so only trusted clients can reach the blob upload, create, and pull routes.
Place Ollama behind an authenticating reverse proxy that enforces client identity before requests reach the parser.
Update Ollama to a release that postdates commit f0078ae and includes GGUF length validation once available.
Disable model import functionality on production inference servers if it is not required for operations.

Patch Information

At the time of NVD publication, tracking for a fix is available in GitHub Issue #17042 on the Ollama repository. Operators should monitor upstream releases and apply the first version that adds bounds checking between GGUF header length fields and the actual file size.

Workarounds

Block requests to /api/create, /api/pull, and /api/blobs/ at the network edge for any source outside a defined allowlist.
Configure a reverse proxy to reject GGUF uploads below a minimum size threshold or above a plausible maximum size.
Run Ollama under a process supervisor with rate-limited restart policies to slow repeated crash-loop attacks while a patch is applied.
Deploy Ollama in isolated containers with strict memory limits so a crash affects only the sandboxed instance.

bash

# Example: restrict Ollama API access with an nginx reverse proxy allowlist
location ~ ^/api/(create|pull|blobs/) {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://127.0.0.1:11434;
}