CVE-2025-66960: 
NixOS vulnerability analysis and mitigation

CVE-2025-66960 is a denial-of-service vulnerability in Ollama v0.12.10 caused by improper input validation in the GGUF file parsing logic. The readGGUFV1String function in fs/ggml/gguf.go reads a string length from untrusted GGUF metadata without bounds checking, enabling uncontrolled resource consumption. The vulnerability was published on January 21, 2026, with an initial analysis completed by February 2, 2026. It carries a CVSS v3.1 base score of 7.5 (High), assessed by CISA-ADP (Feedly, NVD).

The root cause is classified under CWE-20 (Improper Input Validation) and CWE-400 (Uncontrolled Resource Consumption). The readGGUFV1String function in fs/ggml/gguf.go trusts the string length field embedded in GGUF v1 metadata without validating it against safe bounds, leading to a makeslice: len out of range panic when an oversized or malicious length value is encountered. An attacker can trigger this by supplying a crafted GGUF file — either by uploading it directly to an exposed Ollama API endpoint or by causing the server to process it via a model creation request. No authentication or user interaction is required, as the Ollama API is network-accessible by default (GitHub Issue, Zero Shot Blog).

Successful exploitation causes the Ollama server process to panic and crash, resulting in a complete loss of service availability. Since no authentication is required and the attack is network-accessible, any internet-exposed Ollama instance is at risk. There is no confidentiality or integrity impact; the vulnerability is limited to availability, but repeated exploitation could keep the service persistently unavailable (Feedly, NVD).

Proof-of-concept exploit details are publicly available via a GitHub issue and a dedicated technical blog post (GitHub Issue, Zero Shot Blog). There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.149%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Reconnaissance: Identify internet-facing Ollama instances (default port 11434) using tools like Shodan or Censys, targeting version 0.12.10.
2. Craft malicious GGUF file: Create a GGUF v1 format file with a metadata string length field set to an extremely large or invalid value (e.g., exceeding Go's makeslice safe bounds) to trigger the panic in readGGUFV1String.
3. Upload via API: Send an HTTP POST request to the Ollama API endpoint (e.g., /api/blobs/<sha256> or /api/create) with the crafted GGUF file as the payload, requiring no authentication credentials.
4. Trigger crash: The server processes the malicious GGUF metadata, the readGGUFV1String function attempts to allocate a slice of the attacker-controlled length, and the Go runtime panics with makeslice: len out of range, crashing the Ollama server process.
5. Repeat for persistent DoS: Resubmit the crafted file after any automatic service restart to maintain denial of service (GitHub Issue, Zero Shot Blog).

• Logs: Ollama server logs showing panic: runtime error: makeslice: len out of range followed by a goroutine stack trace referencing readGGUFString or readGGUFV1String in gguf.go; repeated POST requests to /api/blobs/ or /api/create endpoints from the same source IP.
• Network: Unusual or repeated HTTP POST requests to Ollama API endpoints (default port 11434) containing large binary payloads from untrusted external sources; unexpected outbound connections if the service restarts automatically.
• Process: Sudden termination of the Ollama server process (ollama serve) with a non-zero exit code; frequent process restarts if a supervisor (e.g., systemd) is configured to auto-restart the service (GitHub Issue, Zero Shot Blog).

A patch was made available as of February 2, 2026; users should upgrade Ollama to a version beyond v0.12.10. As an immediate workaround, restrict network access to the Ollama API (port 11434) using firewall rules or network-level controls to prevent untrusted sources from submitting GGUF files. Monitor for suspicious GGUF file uploads or model creation requests, and consider disabling the Ollama service if it is exposed to untrusted networks until patching is complete (Feedly, GitHub Issue).

The vulnerability received brief attention on social media, with a mention noted on Bluesky via The Hacker Wire account shortly after disclosure. No significant vendor statements beyond the GitHub issue tracker entry have been published, and broader media coverage has been limited given the moderate severity and lack of confirmed in-the-wild exploitation (Feedly).