A denial-of-service vulnerability in Ollama version 0.7.1 allows remote attackers to crash the service by exploiting improper array index validation.

This flaw (CWE-129) occurs within the downloadBlob function, where improper validation of array indices allows an unauthenticated remote attacker to trigger a crash, leading to a denial-of-service condition.

The CVSS score of 7.5 reflects the high impact on service availability. An attacker can remotely disrupt the operation of the Ollama service, resulting in downtime for any applications or workflows dependent on the model-running platform.

Immediate Action: Monitor official Ollama release channels for a patch and update to the latest available version as soon as it is released.

Proactive Monitoring: Monitor service uptime and logs for crash events or unexpected process terminations that may indicate exploitation attempts.

Compensating Controls: Limit access to the Ollama API interface via a firewall or reverse proxy to only allow trusted clients, thereby reducing the risk of exploitation by unauthorized remote actors.

Public Exploit Available: No

Given the potential for service disruption, users should restrict network access to the Ollama service interface as a temporary measure. Once a fix is provided by the vendor, it should be deployed as a matter of priority to restore the availability and stability of the platform.