CVE-2026-15685: Ollama downloadBlob array index

CISO Take

This CVE is an unauthenticated denial-of-service flaw in Ollama's downloadBlob function, where malformed input triggers an out-of-bounds array access (CWE-129) and crashes the service. Ollama sits behind roughly 1,620 downstream dependents and carries a package risk score of 84/100 with 27 other known CVEs, so the blast radius for anything built on it as an inference backend is meaningful even though this specific bug only causes a crash rather than code execution or data compromise. Exploitation likelihood is low right now — EPSS sits at 0.39% (top 69th percentile), it's not in CISA KEV, and there's no public exploit or Nuclei template yet — so this is not an emergency-patch-tonight situation. The practical risk driver is Ollama's well-documented pattern of being exposed on its API port (11434) without authentication; teams should confirm Ollama instances are not internet-facing, monitor for crash-loop/restart patterns on the ollama service, and apply the vendor fix referenced in ZDI-26-403 as soon as it's available in a release.

Sources: NVD EPSS ATLAS

What is the risk?

Low-to-moderate risk today. The vulnerability requires no authentication and no user interaction, which lowers the exploitation bar, but the impact ceiling is denial-of-service only — no data exfiltration, model manipulation, or code execution path is described. Absence from CISA KEV, a sub-1% EPSS score, and no known public exploit or scanner template all point to low current in-the-wild exploitation probability. The main amplifier is exposure: Ollama is frequently deployed with its API reachable without an auth layer, which converts a low-severity local bug into an internet-reachable disruption vector for any service depending on that instance for inference.

How does the attack unfold?

Recon

Adversary scans for internet- or network-reachable Ollama instances, typically on the default API port 11434.

AML.T0006

Exploitation

Adversary sends a crafted request to the downloadBlob/model-pull endpoint with malformed data that drives an array index past its allocated bounds.

AML.T0049

Impact

The Ollama process crashes, causing a denial-of-service outage for every downstream application relying on that inference instance.

AML.T0029

Recon

Adversary scans for internet- or network-reachable Ollama instances, typically on the default API port 11434.

AML.T0006

Exploitation

Adversary sends a crafted request to the downloadBlob/model-pull endpoint with malformed data that drives an array index past its allocated bounds.

AML.T0049

Impact

The Ollama process crashes, causing a denial-of-service outage for every downstream application relying on that inference instance.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Ollama	pip	—	No patch
181.3K 1.8K dependents Pushed 2d ago 15% patched ~36d to patch Full package profile →

Do you use Ollama? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.7%

chance of exploitation in 30 days

Higher than 52% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Track the Ollama GitHub repository/release notes for a fix addressing ZDI-26-403 and upgrade as soon as a patched version ships (no patched version is specified in the current advisory). In the interim, do not expose the Ollama API port (default 11434) directly to untrusted networks or the public internet — bind it to localhost or an internal network and front it with an authenticated reverse proxy. Add input validation/size limits at that proxy layer for model-pull/blob-download requests, and add monitoring/alerting on unexpected Ollama process restarts or crash-loop behavior as a detection signal for attempted exploitation.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Inference AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-15685?

This CVE is an unauthenticated denial-of-service flaw in Ollama's downloadBlob function, where malformed input triggers an out-of-bounds array access (CWE-129) and crashes the service. Ollama sits behind roughly 1,620 downstream dependents and carries a package risk score of 84/100 with 27 other known CVEs, so the blast radius for anything built on it as an inference backend is meaningful even though this specific bug only causes a crash rather than code execution or data compromise. Exploitation likelihood is low right now — EPSS sits at 0.39% (top 69th percentile), it's not in CISA KEV, and there's no public exploit or Nuclei template yet — so this is not an emergency-patch-tonight situation. The practical risk driver is Ollama's well-documented pattern of being exposed on its API port (11434) without authentication; teams should confirm Ollama instances are not internet-facing, monitor for crash-loop/restart patterns on the ollama service, and apply the vendor fix referenced in ZDI-26-403 as soon as it's available in a release.

Is CVE-2026-15685 actively exploited?

No confirmed active exploitation of CVE-2026-15685 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-15685?

Track the Ollama GitHub repository/release notes for a fix addressing ZDI-26-403 and upgrade as soon as a patched version ships (no patched version is specified in the current advisory). In the interim, do not expose the Ollama API port (default 11434) directly to untrusted networks or the public internet — bind it to localhost or an internal network and front it with an authenticated reverse proxy. Add input validation/size limits at that proxy layer for model-pull/blob-download requests, and add monitoring/alerting on unexpected Ollama process restarts or crash-loop behavior as a detection signal for attempted exploitation.

What systems are affected by CVE-2026-15685?

This vulnerability affects the following AI/ML architecture patterns: model serving, RAG pipelines, agent frameworks.

What is the CVSS score for CVE-2026-15685?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

model servingRAG pipelinesagent frameworks

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ollama. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloadBlob function. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated array. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-27277.

Exploitation Scenario

An attacker scans for exposed Ollama instances on port 11434 (a known misconfiguration pattern for internal AI tooling accidentally left internet-facing), then sends a crafted request to the model-pull/blob-download endpoint with malformed data that drives downloadBlob's array index past its allocated bounds. The out-of-bounds access crashes the Ollama process, taking down inference for every application wired to that instance — chatbots, RAG backends, or agent frameworks — until an operator or supervisor restarts the service, with the attacker able to repeat the crash on demand to sustain the outage.

Weaknesses (CWE)

CWE-129 Improper Validation of Array Index Primary CWE-129 Improper Validation of Array Index

CWE-129 — Improper Validation of Array Index: The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server. Even though client-side checks provide minimal benefits with respect to server-side security, they are still useful. First, they can support intrusion detection. If the server receives input that should have been rejected by the client, then it may be an indication of an attack. Second, client-side error-checking can provide helpful feedback to the user about the expectations for valid input. Third, there may be a reduction in server-side processing time for accidental input errors, although this is typically a small savings.

Source: MITRE CWE corpus.