Ollama Security.
This section contains technical analysis, proof-of-concept demonstrations, and reproduction material for multiple security vulnerabilities identified in Ollama.
The findings documented here focus on denial-of-service conditions caused by improper handling of untrusted model data during model import and conversion.
GGUF String Length Panic
A malformed GGUF file can trigger a runtime panic through an attacker-controlled string length field. The parser reads an untrusted 64-bit length value and uses it directly during memory allocation without sufficient bounds validation. This results in panic: runtime error: makeslice: len out of range leading to immediate service termination.
Resource Exhaustion via Unbounded vocab_size
The model conversion pipeline accepts an attacker-controlled vocab_size value from config.json and uses it to drive vocabulary padding operations. Because no upper bound is enforced, an attacker can force excessive memory allocations and CPU consumption.
Repository Structure
ollama-security-research/
│
├── README.md
│
├── gguf-string-panic/
│ ├── README.md
│ └── exploit.py
│
└── vocabsize-resource-exhaustion/
├── README.md
└── exploit.pyCoordinated Disclosure
The findings contained in this repository were originally reported through coordinated disclosure channels. The repository serves as a technical reference for researchers, defenders, and developers interested in understanding the root causes, impact, and exploitation paths of these vulnerabilities.
Disclaimer
This repository is intended for educational, defensive, and research purposes only. Do not test against systems you do not own or have explicit authorization to assess.