Critical DoS Vulnerability (ZDI‑26‑403) in Ollama’s downloadBlob Function Allows Unauthenticated Service Disruption
What Happened — A newly disclosed vulnerability (ZDI‑26‑403) in Ollama’s downloadBlob function permits remote attackers to trigger a denial‑of‑service condition without authentication by exploiting improper validation of an array index. The flaw can cause memory access beyond allocated bounds, crashing the service.
Why It Matters for Compliance & Audit Readiness —
- Availability is a core SOC 2 Trust Service Criterion; an unpatched DoS flaw directly jeopardizes that control.
- Continuous control monitoring and evidence of timely remediation are required to demonstrate due diligence in a SOC 2 audit.
- Mapping this vulnerability to your control framework helps produce defensible audit artifacts and supports the Control Mapping capability.
Who Is Affected — SaaS providers, AI/ML platform operators, and any organization embedding Ollama’s LLM engine in production workloads.
Recommended Actions —
- Verify whether Ollama instances are exposed to untrusted networks; apply vendor‑provided mitigations or restrict access.
- Update your asset inventory and map the vulnerability to the SOC 2 Availability control (CC6.1).
- Implement continuous monitoring for service‑availability anomalies and retain remediation evidence for audit review.
Source: Zero Day Initiative advisory
Technical Notes — The issue resides in the downloadBlob function, leading to out‑of‑bounds memory access; CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No authentication required. Source: ZDI advisory