—

GO-2026-5748

Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader in github.com/ollama/ollama

Quick fix

GO-2026-5748 — github.com/ollama/ollama: upgrade to the fixed version with the command below.

go get github.com/ollama/ollama@v0.17.1

Details

Ollama is vulnerable to a heap out-of-bounds read in its GGUF model loader. A specially crafted GGUF file can cause the loader to read beyond the allocated heap buffer, potentially leading to a denial of service (crash).

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/ollama/ollama

Introduced in: 0 Fixed in: 0.17.1

Fix go get github.com/ollama/ollama@v0.17.1

References

https://github.com/advisories/GHSA-x8qc-fggm-mpqg [ADVISORY]
https://github.com/ollama/ollama/commit/88d57d0483cca907e0b23a968c83627a20b21047 [FIX]
https://github.com/ollama/ollama/pull/14406 [FIX]
https://github.com/ollama/ollama/releases/tag/v0.17.1 [WEB]