CVE-2025-66959

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder

High · published January 21, 2026

CVSS v3.1
7.5
EPSS
5%
Percentile
92.6
In the wild
Unconfirmed
What it is

⚡ A remote attacker can bring your service to its knees with just a crafty message! This denial of service vulnerability in ollama v.0.12.10 is like a mischievous prankster jamming the reception at your favorite café. ☕️ Imagine a bustling restaurant where one unruly diner keeps asking for special orders that overwhelm the kitchen — suddenly no one gets served, and chaos reigns! That's what happens here when an attacker leverages the GGUF decoder in ollama. With this vulnerability, an attacker could trigger a denial of service, meaning your application might become unresponsive, leaving your users hanging! This interruption can lead to serious reputational damage and loss of user trust — nobody likes a service that can't deliver!

Put simply

Imagine a bustling restaurant where one unruly diner keeps asking for special orders that overwhelm the kitchen — suddenly no one gets served, and chaos reigns! That's what happens here when an attacker leverages the GGUF decoder in ollama. This denial of service flaw arises from an issue in the GGUF decoder of ollama v.0.12.10, allowing a remote attacker to exploit it and potentially crash the service.

What to do

With this vulnerability, an attacker could trigger a denial of service, meaning your application might become unresponsive, leaving your users hanging! This interruption can lead to serious reputational damage and loss of user trust — nobody likes a service that can't deliver! To protect yourself, update to the latest version of ollama as soon as possible to ensure you eliminate this vulnerability. Regularly monitor your system for unusual activity and consider implementing rate limiting to mitigate potential attacks in the future. You've got this! Patch up, stay vigilant, and you'll keep your application running smoothly. 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.05326 · 92.6th percentile
Published
2026-01-21T00:00Z
EPSS history
Timeline
  • 21 JAN 00:00Z
    An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder
    cvelistv5