ollama - 💡(How to fix) Fix No blob size limits during model pull — malicious registry can exhaust disk space

CWE-400: No Blob Size Limits During Model Pull — Disk Exhaustion DoS

Severity: MEDIUM (CVSS 5.3)

Location

server/images.go — pullWithTransfer() and downloadBlob()

Description

When pulling a model, Ollama downloads blobs from the registry without any configurable size limit:

func pullWithTransfer(ctx context.Context, n model.Name, layers []manifest.Layer, ...) error {
    // No validation of total download size
    if err := transfer.Download(ctx, transfer.DownloadOptions{
        Blobs:   blobs,    // sizes from manifest — attacker-controlled
        DestDir: destDir,  // writes to disk without limits
        ...
    }); err != nil { ... }
}

The only limits are:

1. Individual blob sizes from the manifest (attacker-controlled)
2. Filesystem free space (OS-level, not enforced by Ollama)

A malicious registry can serve a manifest claiming small blob sizes but streaming extremely large payloads, or a manifest with many large blobs, causing:

• Disk exhaustion on the Ollama host
• Denial of service for other applications
• In extreme cases, system crash when disk fills

Impact

An attacker operating a malicious model registry (or a compromised legitimate registry) can cause disk exhaustion on any machine that pulls models from it.

Remediation

1. Add OLLAMA_MAX_MODEL_SIZE environment variable (e.g., default 500GB)
2. Validate Content-Length header against declared blob size before streaming
3. Add per-blob size limits with configurable maximum
4. Check available disk space before and during download, abort if below threshold