Ollama at a glance
A crafted GGUF file sent to Ollama's create endpoint could make the server read past a heap buffer and push leaked memory, including prompts and secrets, to an attacker's registry. Versions before 0.17.1 are affected.
Ollama: status
- Affected
- Ollama versions before 0.17.1
- CVE identifiers
- Status as of
- Discovered by
- Dor Attias, Cyera Research
What changed with Ollama
CVE-2026-7482, nicknamed Bleeding Llama by Cyera, is a heap out-of-bounds read in Ollama's GGUF model loader, published in NVD on May 4, 2026 with a CVSS 3.1 score of 9.1 (critical). An attacker uploads a GGUF file whose declared tensor sizes exceed the real data, triggers model creation through /api/create, and the quantization step copies adjacent heap memory into the new model. The attacker can then use /api/push to send that model to a registry they control. Neither endpoint requires authentication.
Ollama binds to 127.0.0.1 by default, but NVD notes that setting OLLAMA_HOST=0.0.0.0 is common and exposes the API. Cyera says it reported the bug on February 2, 2026; the fix shipped in Ollama 0.17.1 without being labeled as a security fix in the release notes.
A related CERT/CC note, VU#518910 (CVE-2026-5757), published April 22, describes a similar GGUF quantization memory leak, lists Ollama 0.13.5 as affected, and says no patch was available and the vendor could not be reached. Its NVD record still lists no fixed version, and no official source confirms whether 0.17.1 resolves it. The reporter said AI-assisted research found that issue.
How to fix it: Ollama
2. Configuration
Keep Ollama on local or trusted networks only, and restrict or disable model upload on any internet-exposed deployment.
kb.cert.org (opens in a new tab)
Advisories
- NVD CVE-2026-7482 (opens in a new tab)nvd.nist.gov
- CERT/CC VU#518910 (CVE-2026-5757) (opens in a new tab)kb.cert.org
- NVD CVE-2026-5757 (opens in a new tab)nvd.nist.gov
Where to compare Ollama
Independent leaderboards and official resources for comparing this model yourself. Rankings change often; each site shows its own current data.
Why Ollama matters for businesses
Ollama is a common way to run open models on office servers and developer machines. Process memory can hold other users' prompts, system prompts, and environment variables with API keys, so any instance reachable from a network should be upgraded, kept off the public internet, and placed behind authentication.
Sources for this story
- CVE-2026-7482 Detail (opens in a new tab)Official
NIST National Vulnerability Database · nvd.nist.gov
- Ollama v0.17.1 release (opens in a new tab)Official
Ollama on GitHub · github.com
- ggml: ensure tensor size is valid (PR #14406) (opens in a new tab)Official
Ollama on GitHub · github.com
- VU#518910: Ollama GGUF Quantization Remote Memory Leak (opens in a new tab)Official
CERT Coordination Center · kb.cert.org
- Bleeding Llama: Critical Unauthenticated Memory Leak in Ollama (opens in a new tab)Press
Cyera Research · cyera.com
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #cve
- #ollama
- #local-models
- #self-hosting