Security research identified five vulnerabilities in Ollama and LiteLLM, disclosed after 90 days via Huntr. Ollama's vulnerabilities include a GGUF parser panic triggered by an attacker-controlled 64-bit string length field without proper bounds checking, causing a runtime panic and service crash (denial of service). Another Ollama issue involves an unbounded vocab_size parameter used during model conversion, allowing attackers to cause excessive memory and CPU consumption, leading to resource exhaustion and host instability. LiteLLM vulnerabilities include a Pass-the-Hash authentication bypass, an SSRF vulnerability through custom guardrails, and a Unicode normalization issue that could lead to sandbox escape scenarios. The research highlights security risks in AI model handling, resource allocation, authentication logic, network trust boundaries, and Unicode edge cases. Technical repositories provide detailed analyses, proof-of-concept code, and remediation suggestions.

The vulnerabilities in Ollama can cause remote denial of service through service crashes and resource exhaustion, potentially leading to complete loss of availability and host instability. LiteLLM's vulnerabilities include authentication bypass, which could allow unauthorized access, SSRF attacks that may enable internal network access, and sandbox escape risks that could compromise containment mechanisms. These impacts affect the confidentiality, integrity, and availability of the affected AI infrastructure components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The disclosures include remediation recommendations; users and administrators should review the published technical details and apply any available fixes or mitigations. Since these vulnerabilities were responsibly disclosed and published after a 90-day period, it is recommended to monitor the official repositories and vendor advisories for patches or updates addressing these issues. Until patches are applied, consider restricting access to vulnerable components and carefully validating inputs related to model parsing, resource parameters, authentication, and network requests.