| ---
|
| license: apache-2.0
|
| tags:
|
| - security
|
| - proof-of-concept
|
| - denial-of-service
|
| ---
|
|
|
| # ollm (oLLM) header DoS — PoC model file
|
|
|
| Security proof-of-concept for a Denial-of-Service in
|
| [`Mega4alik/ollm`](https://github.com/Mega4alik/ollm) (PyPI `ollm`, commit `6d1705a`).
|
| Reported via huntr's Model File Vulnerability program.
|
|
|
| oLLM ships its own hand-rolled safetensors parser (`SafeTensorReader`) with **zero**
|
| header validation. `model.safetensors` is a 13-byte file whose header is not valid
|
| JSON. Loading it through the parser crashes the process with an uncaught
|
| `json.JSONDecodeError`, at model-load time, before any tensor data is read. This
|
| affects any app using ollm to load a model (its core use case — it streams models
|
| downloaded from the Hugging Face Hub).
|
|
|
| ## Reproduce
|
| `pip install ollm` — no GPU required, crash precedes any torch/CUDA op:
|
| ```python
|
| from ollm.gds_loader import SafeTensorReader
|
| SafeTensorReader("model.safetensors")
|
| # -> json.decoder.JSONDecodeError (uncaught -> loader crash) |
