File size: 1,040 Bytes
6b88d5d | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 | ---
license: apache-2.0
tags:
- security
- proof-of-concept
- denial-of-service
---
# ollm (oLLM) header DoS — PoC model file
Security proof-of-concept for a Denial-of-Service in
[`Mega4alik/ollm`](https://github.com/Mega4alik/ollm) (PyPI `ollm`, commit `6d1705a`).
Reported via huntr's Model File Vulnerability program.
oLLM ships its own hand-rolled safetensors parser (`SafeTensorReader`) with **zero**
header validation. `model.safetensors` is a 13-byte file whose header is not valid
JSON. Loading it through the parser crashes the process with an uncaught
`json.JSONDecodeError`, at model-load time, before any tensor data is read. This
affects any app using ollm to load a model (its core use case — it streams models
downloaded from the Hugging Face Hub).
## Reproduce
`pip install ollm` — no GPU required, crash precedes any torch/CUDA op:
```python
from ollm.gds_loader import SafeTensorReader
SafeTensorReader("model.safetensors")
# -> json.decoder.JSONDecodeError (uncaught -> loader crash) |