CVE-2026-7482 — Bleeding Llama: Ollama Heap OOB Read Memory Leak¶

Q: How do I detect CVE-2026-7482?

Deploy the Snort detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

Q: How do I block or mitigate CVE-2026-7482?

Apply the Nginx mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

Key facts

CVE-2026-7482 is a Critical (9.1) vulnerability: Bleeding Llama: Ollama Heap OOB Read Memory Leak. This entry ships ready-to-deploy detection and prevention rules (Snort, Nginx) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-7482
Severity	Critical (9.1)
Product	Ollama < 0.17.1
Detection / prevention	Snort, Nginx
PoC	poc.py
Source	2026/CVE-2026-7482/

Details¶

CVE-2026-7482 (Ollama < 0.17.1) is a Critical (9.1) vulnerability: Bleeding Llama: Ollama Heap OOB Read Memory Leak. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, Nginx) — see Detection and prevention below. Source: NVD record.

Overview¶

Field	Value
CVE ID	CVE-2026-7482
CVSS	9.1 (CRITICAL)
Type	Heap Out-of-Bounds Read / Information Disclosure
Product	Ollama < 0.17.1
Affected	~300,000 internet-facing servers
Fixed	Ollama v0.17.1 (2026-02-25)
Alias	Bleeding Llama
Discoverer	Dor Attias (Cyera Research)

Description¶

Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker-supplied GGUF file in which the declared tensor offset and size exceed the file's actual length. During quantization in fs/ggml/gguf.go and server/quantization.go (WriteTo()), the server reads past the allocated heap buffer.

The leaked memory may include: - Environment variables (API keys, secrets) - System prompts (proprietary instructions) - User conversation data (privacy breach) - Internal configuration (infrastructure details)

Attack Flow¶

1. POST /api/create ← crafted GGUF with inflated tensor shape
2. OOB heap read during WriteTo() → server reads past buffer
3. Float16→Float32 lossless conversion preserves stolen bytes
4. POST /api/push → exfiltrate model to attacker-controlled registry

All three API calls require no authentication in default Ollama deployments.

Detection¶

python3 poc.py                           # Check localhost
python3 poc.py http://target:11434       # Check remote

Remediation¶

Upgrade to Ollama v0.17.1+ (primary fix)
Do NOT bind to 0.0.0.0 — use OLLAMA_HOST=127.0.0.1
Add reverse proxy auth (nginx/caddy with basic auth)
Firewall Ollama port 11434 from external access
Monitor /api/create and /api/push for suspicious usage

References¶

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-7482, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
Nginx mitigation — prevention/nginx.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-7482 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureNginx mitigation

# CVE-2026-7482 Bleeding Llama — Detect exploitation attempts
# Triggers on /api/create with GGUF content and /api/push to external registries

alert tcp any any -> any 11434 (msg:"CVE-2026-7482 Ollama /api/create GGUF upload attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/create"; http_uri; content:"GGUF"; fast_pattern; classtype:attempted-admin; sid:2026748201; rev:1;)

alert tcp any any -> any 11434 (msg:"CVE-2026-7482 Ollama /api/push potential data exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/api/push"; http_uri; classtype:attempted-admin; sid:2026748202; rev:1;)

alert tcp any any -> any 11434 (msg:"CVE-2026-7482 Ollama external binding detected (0.0.0.0)"; flow:to_server,established; content:"GET"; http_method; content:"/api/version"; http_uri; classtype:policy-violation; sid:2026748203; rev:1;)

:material-file-download: prevention/snort.rules

# Nginx reverse proxy for Ollama with authentication
# Blocks unauthenticated access to /api/create and /api/push

upstream ollama {
    server 127.0.0.1:11434;
}

server {
    listen 8080;
    server_name _;

    # Require auth for dangerous endpoints
    location ~ ^/api/(create|push|copy|delete) {
        auth_basic "Ollama Admin";
        auth_basic_user_file /etc/nginx/.htpasswd;

        proxy_pass http://ollama;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        client_max_body_size 10G;
    }

    # Allow public read-only endpoints
    location ~ ^/api/(generate|chat|tags|show|embeddings|version) {
        proxy_pass http://ollama;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_read_timeout 600s;
    }

    # Block everything else
    location / {
        return 403;
    }
}

:material-file-download: prevention/nginx.conf

Frequently asked questions¶

What is CVE-2026-7482?¶

CVE-2026-7482 is a Critical (9.1) vulnerability: Bleeding Llama: Ollama Heap OOB Read Memory Leak. This entry ships ready-to-deploy detection and prevention rules (Snort, Nginx) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-7482?¶

Deploy the Snort detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-7482?¶

Apply the Nginx mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.