CVE-2025-66959

Executive Summary

CVE-2025-66959 is a denial-of-service (DoS) vulnerability in Ollama version 0.12.10, specifically within the GGUF decoder component. A remote attacker can exploit this flaw to cause the application to crash or become unresponsive, leading to service disruption. The vulnerability arises from improper input validation in the GGUF decoder, allowing specially crafted GGUF files to trigger an infinite loop or resource exhaustion. No public proof-of-concept (PoC) or patch is currently available, and the CVSS score is listed as 0.0, indicating incomplete scoring. The EPSS score is 0.0%, suggesting low exploitation likelihood at this time, but the lack of a patch makes this a high-priority issue for organizations using Ollama.

Supply Chain & Package Security

Ollama is distributed as a standalone binary and via package managers like Homebrew and Docker. The vulnerability affects the GGUF decoder, which is a core component for loading model files. Organizations should verify the integrity of downloaded Ollama binaries and monitor for updates from the official repository. Since no patch exists, users should consider restricting access to the GGUF decoder or implementing network-level controls to mitigate risk.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is unusual and likely indicates incomplete or missing scoring data. Based on the description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – remote attacker
• Attack Complexity (AC): Low (L) – no special conditions
• Privileges Required (PR): None (N) – no authentication needed
• User Interaction (UI): None (N) – no user action required
• Scope (S): Unchanged (U) – affects only the vulnerable component
• Confidentiality (C): None (N) – no data exposure
• Integrity (I): None (N) – no data modification
• Availability (A): High (H) – complete loss of service

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Estimated Base Score: 7.5 (High)

Threat Level: High – due to remote exploitability, low complexity, and no authentication required. However, the lack of a public PoC and low EPSS score reduce immediate risk.

Deep Dive & Mechanics

The GGUF (GPT-Generated Unified Format) is a file format used by Ollama to store and load machine learning models. The decoder is responsible for parsing GGUF files and extracting model data. The vulnerability lies in the decoder's handling of malformed or specially crafted GGUF files. Specifically, the decoder fails to validate certain fields or structures, leading to an infinite loop or excessive resource consumption when processing a malicious file.

Root Cause: Improper input validation in the GGUF decoder. The decoder does not check for recursive or cyclic references in the file's metadata, allowing an attacker to craft a file that causes the decoder to loop indefinitely.

Attack Vector: A remote attacker sends a malicious GGUF file to the Ollama service (e.g., via the API endpoint that accepts model uploads or by tricking a user into loading the file). The decoder processes the file, enters an infinite loop, and consumes CPU resources, causing the service to become unresponsive.

Impact: Denial of service – the Ollama service crashes or becomes unresponsive, affecting all users relying on the service.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, based on the vulnerability description, the fix would involve adding input validation to the GGUF decoder to detect and reject malformed files. Specifically, the decoder should:

• Limit recursion depth when parsing nested structures.
• Validate field sizes and offsets to prevent out-of-bounds access.
• Implement timeouts for parsing operations.

Example of vulnerable code pattern (pseudo-code):

def parse_gguf(data):
    while data.has_more():
        field = read_field(data)
        if field.type == 'nested':
            parse_gguf(field.data)  # No recursion limit

Example of patched code pattern (pseudo-code):

MAX_RECURSION = 10
def parse_gguf(data, depth=0):
    if depth > MAX_RECURSION:
        raise ValueError("Max recursion depth exceeded")
    while data.has_more():
        field = read_field(data)
        if field.type == 'nested':
            parse_gguf(field.data, depth + 1)

Exploitation & Lab Setup

Red Team

Objective: Cause a denial of service on an Ollama instance.

Prerequisites:

• Access to the Ollama API (e.g., http://target:11434).
• Ability to send HTTP requests.

Steps:

1. Craft a malicious GGUF file that triggers the infinite loop. Since no public PoC exists, the attacker would need to reverse-engineer the GGUF decoder to find the vulnerable code path.
2. Send the file to the Ollama API endpoint that accepts model uploads (e.g., POST /api/create with a path parameter pointing to the malicious file).
3. Alternatively, if the attacker can trick a user into loading the file via the Ollama CLI, the service will crash.

Example exploit (conceptual):

import requests

url = "http://target:11434/api/create"
malicious_gguf = b"\x00" * 1000  # Placeholder for crafted data
files = {"file": ("malicious.gguf", malicious_gguf)}
response = requests.post(url, files=files)
print(response.text)

Note: This is a conceptual example. Actual exploitation requires a crafted GGUF file.

Blue Team

Detection:

• Monitor for unusual CPU spikes on Ollama servers.
• Log and alert on failed GGUF file parsing attempts.
• Use network monitoring to detect large or malformed GGUF files being uploaded.

Mitigation:

• Restrict access to the Ollama API to trusted IPs only.
• Implement rate limiting on file uploads.
• Use a reverse proxy to inspect and validate GGUF files before they reach the Ollama service.
• Disable the GGUF decoder if not needed, or use a sandboxed environment.

Indicators of Compromise (IOCs)

• Network: Unusual HTTP POST requests to /api/create with large or malformed GGUF files.
• System: High CPU usage by the Ollama process, leading to service unavailability.
• Logs: Error messages related to GGUF parsing, such as "infinite loop detected" or "timeout exceeded".
• File: Malicious GGUF files with unusual structure (e.g., deeply nested fields, large metadata sections).

Example log entry:

[ERROR] GGUF decoder: maximum recursion depth exceeded

Detection Engineering

YARA Rule

rule CVE_2025_66959_GGUF_Decoder_DoS {
    meta:
        description = "Detects malicious GGUF files exploiting CVE-2025-66959"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66959"
    strings:
        $magic = "GGUF"
        $nested_field = { 01 00 00 00 }  // Example: nested field type indicator
    condition:
        $magic at 0 and #nested_field > 100  // Excessive nested fields
}

Sigma Rule

title: CVE-2025-66959 - Ollama GGUF Decoder DoS
id: cve-2025-66959-gguf-dos
status: experimental
description: Detects attempts to exploit CVE-2025-66959 by uploading malicious GGUF files
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: ollama
detection:
    selection:
        http.method: "POST"
        http.url: "/api/create"
        http.body|contains: "GGUF"
    condition: selection
falsepositives:
    - Legitimate GGUF file uploads
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66959 - Ollama GGUF Decoder DoS Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/api/create"; http.request_body; content:"GGUF"; depth:4; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Network Access: Limit access to the Ollama API to trusted IPs using firewall rules.
2. Disable Unused Features: If the GGUF decoder is not required, disable it in the configuration.
3. Monitor for Anomalies: Implement logging and alerting for unusual CPU usage or failed GGUF parsing attempts.

Long-Term Fix:

• Await an official patch from Ollama. Monitor the official repository for updates.
• Once a patch is available, upgrade to the latest version immediately.
• Consider using a Web Application Firewall (WAF) to inspect and block malicious GGUF files.

Workaround:

• Use a reverse proxy (e.g., Nginx) to validate GGUF files before forwarding them to the Ollama service. The proxy can check for file size limits and basic structure.

Valters IT
Securing Digital Frontiers