Executive brief
An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function readGGUFV1String reads a string length from untrusted GGUF metadata
Affected products
- PyPI ollama
Junglewise Threat Intelligence
CVE-2025-66960: PYSEC-2026-102 - An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function readGGUFV1String reads
CVE-2025-66960 · Severity: low · CVSS 3.1 · Published 2026-01-21
Technologies: ollama (PyPI). Vendors: PyPI.
Related threats
- Ollama downloadBlob improper validation of array index denial of service
- PYSEC-2026-101 - An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder
- GO-2025-3851 - Ollama allows deletion of arbitrary files in github.com/ollama/ollama
- Ollama Cross-Domain Token Exposure in model pull mechanism
- Ollama Server DoS via improper array index validation in /api/pull