CVE-2026-15685
Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ollama. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloadBlob function. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated array. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-27277.
| CWE | CWE-129 |
| Vendor | ollama |
| Product | ollama |
| Published | Jul 13, 2026 |
| Last Updated | Jul 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for ollama ollama
Be the first to know when new high vulnerabilities affecting ollama ollama are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Versions
Ollama / Ollama
0.7.1