GO-2026-5748

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-5748

Import Source

https://vuln.go.dev/ID/GO-2026-5748.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-5748

Aliases

Published

2026-07-27T15:30:50Z

Modified

2026-07-27T17:00:22.536508632Z

Summary

Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader in github.com/ollama/ollama

Details

Ollama is vulnerable to a heap out-of-bounds read in its GGUF model loader. A specially crafted GGUF file can cause the loader to read beyond the allocated heap buffer, potentially leading to a denial of service (crash).

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-5748"
}

References

Affected packages

Go / github.com/ollama/ollama

Package

Name: github.com/ollama/ollama; View open source insights on deps.dev
Purl: pkg:golang/github.com/ollama/ollama

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.17.1

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/ollama/ollama/server",
            "symbols": [
                "WriteTo",
                "quantizer.WriteTo"
            ]
        },
        {
            "path": "github.com/ollama/ollama/fs/ggml",
            "symbols": [
                "Decode",
                "gguf.Decode"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5748.json"