Ollama: Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability
Ollama
More for Ollama RSS feed for Ollama
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Record
- CVE-2026-15685
- Affects
- Ollama
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 13, 2026
- Source last modified
- July 14, 2026
Description
Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ollama. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the downloadBlob function. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated array. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-27277.
Description quoted from the NVD record.
Who is affected
This problem affects Ollama, a program that runs AI language models on your own computer or server so that other apps can send it requests. The flaw is in the part of Ollama that downloads model files. An attacker who can reach Ollama over a network, without needing to log in, can send it specially crafted data that makes it reach past the edge of its memory, which can stop Ollama from working (a denial-of-service attack). No specific affected versions are named for this flaw, so treat any Ollama installation as possibly affected. This flaw is rated High.
What to do
- Find out whether anyone in your organization uses Ollama, and who installed it or runs it: a staff member, a volunteer, or an IT provider.
- If someone in your organization runs it, know that no fixed version is named for this flaw yet. Have them check the vendor advisory linked on this page for a fixed release and install it as soon as one is available.
- If an IT provider or vendor runs Ollama for you, send them this advisory and ask when the update will be done.
- Check the vendor advisory linked on this page again over the coming days until a fixed release is installed.
Analysis written from the source record as of July 14, 2026 and reviewed before publishing.