CVE-2026-15685

Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability

Published Jul 13, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ollama. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the downloadBlob function. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated array. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-27277.

Analysis

Technical impact

Ollama’s downloadBlob function fails to validate the size of user‑supplied data, allowing an attacker to cause a memory access past the end of an allocated array. This failure represents CWE‑129 (Improper Validation of Array Index) and CWE‑787 (Out‑of‑Bounds Write), and results in a crash or restart of the service, creating a denial‑of‑service condition. The vulnerability does not alter confidentiality or integrity, but it can be invoked remotely without authentication.

Affected Systems

All installations of Ollama are potentially affected. No specific version range is listed; any installation that has not applied a vendor fix is at risk.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity impact, while the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The high severity score indicates that a successful exploit would disrupt the service. Based on the description, it is inferred that an attacker can trigger a denial‑of‑service condition remotely without authentication. However, the advisory does not state whether the downloadBlob endpoint is publicly reachable or limited to internal traffic, so the exact exposure level is unknown.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Ollama

unknown

Version	Status	Constraints
`0.7.1`	affected	—

Configuration 1 [-]

cpe:2.3:a:ollama:ollama:0.7.1:-:*:*:*:*:*:*

No data.

Vendor Product Versions

Ollama

Version	Status	Scheme	Platform
`0.7.1`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Restrict access to the downloadBlob endpoint by configuring firewall rules or network segmentation, limiting exposure to authorized networks only.
Monitor system logs for abnormal blob download attempts and consider automating service restarts or generating alerts when repeated failures occur, ensuring anomalous input patterns that could trigger CWE‑129 or CWE‑787 are detected.
Check the vendor’s website for future security updates or temporary workarounds as they become available.

Generated by OpenCVE AI on July 31, 2026 at 11:16 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.715% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-15685
https://www.cve.org/CVERecord?id=CVE-2026-15685
https://www.zerodayinitiative.com/advisories/ZDI-26-403/

History

Jul 16, 2026 12:30 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-15685 https://www.cve.org/CVERecord?id=CVE-2026-15685
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Jul 14, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 13, 2026 10:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Ollama Ollama ollama
Vendors & Products		Ollama Ollama ollama

Jul 13, 2026 9:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ollama. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloadBlob function. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated array. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-27277.
Title		Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability
Weaknesses		CWE-129
References		https://www.zerodayinitiative.com/advisories/ZDI-26-403/
Metrics		cvssV3_0 `{'score': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`