Executive brief
Ollama, a popular tool for running large language models locally, is vulnerable to a flaw that allows an attacker to crash the server. By sending a specially crafted request to the model download interface, a remote user can trigger a system failure, leading to a complete service outage. This prevents legitimate users and applications from accessing AI models until the service is manually restarted.
Technical details
A Denial of Service (DoS) vulnerability exists in Ollama Server version 0.5.11 and earlier due to an improper validation of array index access (CWE-129). The flaw is located within the /api/pull endpoint, which is used for downloading models. An attacker can exploit this by providing a malicious manifest file with customized content that triggers an out-of-bounds array access during the pull process. This results in a server crash. The attack can be executed remotely over the network without authentication or user interaction. As of the advisory date, no patched version has been identified.
Affected products
- Ollama Ollama <= 0.5.11
Timeline
- 2025-05-16: advisory: GitHub Advisory GHSA-wrh5-cmwx-q2qr published
- 2025-05-16: disclosed: CVE-2025-1975 assigned