CVE-2026-65315
Summary
by MITRE • 07/22/2026
Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata array counts that are used as allocation sizes without validation against remaining file size. Attackers can upload a sub-1KB crafted GGUF file via the blob upload and model create or pull API endpoints to trigger unrecoverable Go runtime out-of-memory fatal errors or makeslice panics that bypass recovery middleware and crash the entire server process.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within the Ollama application's GGUF metadata parser implementation where insufficient input validation leads to uncontrolled memory allocation patterns. The flaw specifically manifests when parsing GGUF files through the blob upload and model create or pull API endpoints, allowing remote attackers to craft malicious files that manipulate length and count fields in string lengths, tensor dimension counts, and metadata array counts. These manipulated values are directly used as allocation sizes without proper validation against the remaining file size, creating a scenario where attacker-controlled data can trigger excessive memory allocation requests.
The technical execution of this vulnerability leverages Go's runtime memory management system through the makeslice function, which is called with attacker-controlled parameters that exceed available heap space or reasonable allocation limits. When the parser encounters these crafted values, it attempts to allocate memory blocks that either consume all available system resources or trigger fatal out-of-memory conditions within the Go runtime environment. The vulnerability affects versions including HEAD f0078ae and demonstrates a critical weakness in input sanitization for binary format parsers, particularly those handling structured metadata with variable-length fields.
The operational impact of this vulnerability is severe as it enables complete server crash without any possibility of recovery through standard error handling mechanisms. The Go runtime's out-of-memory fatal errors and makeslice panics bypass the application's normal recovery middleware, resulting in immediate process termination and service disruption. Attackers can exploit this through minimal sub-1KB crafted GGUF files uploaded via API endpoints, making the attack vector both accessible and efficient. This vulnerability directly relates to CWE-704 Uncontrolled Memory Allocation and represents a critical weakness in resource management that could be exploited for denial-of-service attacks against deployed Ollama instances.
Mitigation strategies should focus on implementing strict input validation within the GGUF parser to verify all allocation parameters against available file boundaries before memory allocation occurs. The implementation should enforce reasonable limits on string lengths, tensor dimensions, and metadata array counts while maintaining proper error handling that prevents fatal runtime conditions from propagating to the main process. Additionally, input sanitization should include bounds checking for all variable-length fields in binary formats, ensuring that parsed values cannot exceed predefined maximum thresholds. These defensive measures align with ATT&CK technique T1499.004 Network Denial of Service and should be implemented following secure coding practices that prevent resource exhaustion attacks against application parsers.