CVE-2025-66959: 
NixOS vulnerability analysis and mitigation

CVE-2025-66959 is a denial-of-service vulnerability in Ollama v0.12.10 caused by improper input validation in the GGUF decoder. A remote, unauthenticated attacker can trigger a panic condition by supplying a crafted GGUF file with an unchecked length parameter in the decoder's copy functionality, causing the service to crash. The vulnerability was published on January 21, 2026, and affects specifically Ollama version 0.12.10. It carries a CVSS v3.1 base score of 7.5 (High), assessed by CISA-ADP (Feedly, GitHub Issue).

The root cause is classified under CWE-20 (Improper Input Validation) and CWE-400 (Uncontrolled Resource Consumption). The vulnerability resides in the readGGUFString function within llm/gguf.go, where a length value read from a GGUF file is passed directly to makeslice without bounds checking, triggering a Go runtime panic (makeslice: len out of range) when the value is out of range — particularly on big-endian architectures or with maliciously crafted files. An attacker exploits this by uploading or causing the server to process a specially crafted GGUF model file via the Ollama API (e.g., POST /api/blobs/ or POST /api/create), requiring no authentication or user interaction. A technical write-up and proof-of-concept are publicly available (Zero Shot Learning Blog, GitHub Issue).

Successful exploitation causes the Ollama server process to crash with a Go runtime panic, resulting in complete service unavailability for all users and dependent applications. There is no confidentiality or integrity impact — the vulnerability is limited to availability (DoS). Since Ollama is commonly used as a backend for AI inference services, a crash disrupts all model serving operations until the service is manually restarted (Feedly).

Proof-of-concept exploit details are publicly available via a technical blog post and the referenced GitHub issue, lowering the barrier for exploitation (Zero Shot Learning Blog, GitHub Issue). The vulnerability requires no authentication, no user interaction, and is remotely exploitable over the network, making it trivially accessible to any attacker with network access to the Ollama API. The EPSS score is approximately 0.149%, indicating a currently low but non-negligible probability of exploitation in the wild. There is no confirmed in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog as of the time of this report (Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible Ollama instances running version 0.12.10 using tools like Shodan, Censys, or direct probing of the default port (11434).
2. Craft malicious GGUF file: Create a GGUF file with a malformed or oversized string length field in the metadata section — specifically a value that, when passed to Go's makeslice, exceeds valid bounds (e.g., a very large or negative length encoded in the file).
3. Upload the crafted file: Submit the malicious GGUF file to the Ollama API via POST /api/blobs/sha256:<hash> to stage the blob, or trigger processing via POST /api/create with a Modelfile referencing the crafted GGUF.
4. Trigger the panic: The server's GGUF decoder calls readGGUFString in llm/gguf.go, which passes the unchecked length to makeslice, triggering a Go runtime panic and crashing the Ollama server process.
5. Result: The Ollama service becomes unavailable, requiring manual restart by an administrator (Zero Shot Learning Blog, GitHub Issue).

• Logs: Ollama server logs showing a Go runtime panic message: panic: runtime error: makeslice: len out of range followed by a goroutine stack trace referencing llm/gguf.go (specifically readGGUFString or (*gguf).Decode).
• Logs: HTTP access logs showing POST requests to /api/blobs/sha256:* or /api/create endpoints immediately preceding a service crash.
• Process: Unexpected termination of the ollama server process without a graceful shutdown signal.
• Network: Repeated POST requests to the Ollama API (port 11434 by default) from an external or unexpected IP address, particularly targeting blob upload or model creation endpoints with unusually large payloads.
• File System: Presence of unexpected or malformed .gguf files in the Ollama model storage directory submitted by unknown sources (GitHub Issue, Zero Shot Learning Blog).

Upgrade Ollama to a version beyond 0.12.10, which contains the fix for the unchecked length validation in the GGUF decoder (Feedly). If immediate patching is not possible, restrict network access to the Ollama API (default port 11434) to trusted hosts only using firewall rules or network segmentation. Additionally, consider implementing rate limiting and request size restrictions at the network or reverse proxy level to reduce the attack surface for GGUF-related endpoints.

The vulnerability received brief attention on social media, including a mention on Bluesky by The Hacker Wire and coverage in a Cryptopolitan article discussing hijacking of open-source AI models (Feedly). It also appeared in a Reddit CVE trending list for early February 2026. A HackerNoon article later referenced similar root-cause patterns (unchecked length in ML framework decoders) across multiple AI inference tools. Overall community reaction was moderate, with primary concern focused on the unauthenticated, network-accessible nature of the flaw in a widely used AI serving platform.