CVE-2026-15685

Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ollama. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloadBlob function. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated array. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-27277.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.zerodayinitiative.com/advisories/ZDI-26-403/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ollama:ollama:0.7.1:-:*:*:*:*:*:*

History

14 Jul 2026, 20:59

Type	Values Removed	Values Added
References	~~() https://www.zerodayinitiative.com/advisories/ZDI-26-403/ -~~	() https://www.zerodayinitiative.com/advisories/ZDI-26-403/ - Third Party Advisory
First Time		Ollama ollama Ollama
CPE		cpe:2.3:a:ollama:ollama:0.7.1:-::::::

13 Jul 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-13 22:16

Updated : 2026-07-14 20:59

NVD link : CVE-2026-15685

Mitre link : CVE-2026-15685

CVE.ORG link : CVE-2026-15685

JSON object : View

Products Affected

ollama

ollama

CWE

CWE-129

Improper Validation of Array Index

{"id": "CVE-2026-15685", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15685", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T13:05:12.603465Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "zdi-disclosures@trendmicro.com", "affectedData": [{"vendor": "Ollama", "product": "Ollama", "versions": [{"status": "affected", "version": "0.7.1"}], "defaultStatus": "unknown"}]}], "published": "2026-07-13T22:16:46.123", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-403/", "tags": ["Third Party Advisory"], "source": "zdi-disclosures@trendmicro.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "description": [{"lang": "en", "value": "CWE-129"}]}], "descriptions": [{"lang": "en", "value": "Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ollama. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the downloadBlob function. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated array. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-27277."}], "lastModified": "2026-07-14T20:59:10.293", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ollama:ollama:0.7.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD73D5CE-ECB9-47BD-BB9D-56BCB5EC103E"}], "operator": "OR"}]}], "sourceIdentifier": "zdi-disclosures@trendmicro.com"}