CVE-2026-65315 – Remote Denial of Service via Uncontrolled Memory Allocation in GGUF Parser – Oll…

Summary

CVE-2026-65315 is a high-severity uncontrolled memory allocation vulnerability (CWE-789) in Ollama’s GGUF metadata parser, scored CVSS 4.0: 8.7 / CVSS 3.1: 7.5 (HIGH). An unauthenticated remote attacker can upload a crafted GGUF file as small as 32–40 bytes via Ollama’s model ingestion API endpoints to trigger unrecoverable Go runtime out-of-memory fatal errors or makeslice panics that bypass recovery middleware, crashing the entire server process. All Ollama versions through HEAD commit f0078ae are affected.

Technical details

• Root cause: The GGUF metadata parser in fs/ggml/gguf.go uses attacker-controlled length and count fields — including string lengths, tensor dimension counts, and metadata array counts — as direct memory allocation sizes via make() calls, without first validating them against the remaining file size (CWE-789: Memory Allocation with Excessive Size Value).
• Three distinct vulnerable allocation paths exist: (1) readGGUFString allocates a []byte of the declared string length unconditionally for every key, string value, and array element; (2) gguf.Decode reads a 32-bit tensor dimension count up to 0xFFFFFFFF and allocates up to ~34 GB via make([]uint64, dims), bypassing maxArraySize restrictions; (3) readGGUFArray / newArray is called with an uncapped maxArraySize of -1 on the model create path, allocating make([]T, int(n)) with no upper bound.
• Attack vector: Network-accessible, no authentication or user interaction required. An attacker sends a POST /api/blobs/:digest followed by POST /api/create with a crafted GGUF payload. The vulnerability is also reachable via POST /api/pull using a malicious model registry.
• Impact: Allocation failures produce either a Go runtime fatal error: runtime: out of memory — uncatchable by recover() or gin middleware — or a makeslice: len out of range panic on non-HTTP goroutines. Both outcomes terminate the entire Ollama server process with no automatic recovery, resulting in a complete and persistent denial of service.

Affected software

• Ollama — all versions through HEAD commit f0078ae (all versions prior to the fix introduced in PR #17062, merged July 6, 2026)

Severity

• CVSS 4.0: 8.7 (HIGH) — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
• CVSS 3.1: 7.5 (HIGH) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Mitigation and recommended actions

• Upgrade: A fix was merged into the Ollama main branch via PR #17062 ("create: harden GGUF create flows") on July 6, 2026. Users should upgrade to the latest available Ollama release to receive this patch.
• Network-level mitigation (if immediate upgrade is not possible): Ollama binds to 0.0.0.0 on port 11434 by default with no authentication enabled. Apply firewall rules or network access controls to restrict inbound access to this port to trusted hosts only. This is the primary interim defense against unauthenticated remote exploitation.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-65315 at NIST
• VulnCheck Advisory – Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser
• Ollama GitHub Issue #17042 – GGUF Parser DoS Vulnerability