Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ollama. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloadBlob function. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated array. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-27277.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
[ZDI-26-403|CVE-2026-15685] (0Day) Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability (CVSS 7.5; Credit: Nicholas Zubrisky (@NZubrisky) of Trend Research) https://www.zerodayinitiative.com/advisories/ZDI-26-403/
Post summary
A zero‑day Denial‑of‑Service vulnerability (CVE‑2026‑15685) in Ollama’s downloadBlob has been disclosed, classified as CVSS 7.5, via a ZeroDay Initiative advisory.
🔴 Ollama, Improper Validation of Array Index, #CVE-2026-15685 (High) -DC-Jul2026-994 https://dailycve.com/ollama-improper-validation-of-array-index-cve-2026-15685-high-dc-jul2026-994/
Post summary
A daily CVE notice discloses a high‑severity vulnerability (CVE-2026-15685) in Ollama related to improper array index validation; no PoC, exploit, or patch information is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ollama | ollama | 0.7.1 | - | - |