Ollama Resource Exhaustion via Unbounded vocab_size

🔍 Vulnerability Mechanism

Inside convert/convert.go, the LoadModelMetadata function reads vocab_size from a model’s config.json file. If the vocab_size value is larger than the actual vocabulary size found inside the model file, Ollama enters a loop padding the differences:

for i := range vocabSize - len(t.Vocabulary.Tokens) {
    t.Vocabulary.Tokens = append(t.Vocabulary.Tokens, fmt.Sprintf("[PAD%d]", i))
    t.Vocabulary.Scores = append(t.Vocabulary.Scores, -1)
    t.Vocabulary.Types = append(t.Vocabulary.Types, tokenTypeUserDefined)
}

---

💥 Exploitation Path

An attacker uploads a model defining "vocab_size": 1000000000 (1 Billion) in config.json. The server loops 1 Billion times, calling fmt.Sprintf and appending to slices. This triggers immediate 100% CPU usage on the target server, memory exhaustion, swap locking, and eventual OOM termination, rendering the service offline.