Ollama: malformed base64 image data crashes the model runner via null pointer dereference

Impact

Anyone able to POST to /api/chat can kill the runner process that holds the model, taking the endpoint down for every tenant sharing it until the service is restarted. On a GPU node the cost is not just the crash: the loaded weights leave VRAM and have to be re-staged, so a repeat-fire loop keeps expensive accelerators idle indefinitely. The record describes availability impact only - no memory disclosure or code execution is claimed, and the CVSS vector agrees (VC:N/VI:N/VA:H). Relevant to anyone running Ollama as a shared inference endpoint, including under Red Hat OpenShift AI, which tracks the same flaw.

Who can reach it

Any client that can reach the Ollama HTTP API. Ollama ships with no authentication on that listener, so on a flat cluster network this is unauthenticated and remote; a single crafted chat request is enough.

What to do

The record states 0.11.5-rc0 through 0.13.5 are affected and names no fixed release, so do not plan around a version number yet - check the VulnCheck and Red Hat advisories for the fixed build. Until then, keep the Ollama port off tenant-reachable networks and behind an authenticating proxy, and expect to restart the daemon (or let the supervisor restart the runner) after each crash. Patching is a service restart on the node, not a reboot, but it does drop in-flight sessions and forces a model reload.

References