Security proof-of-concept for a Denial-of-Service in Mega4alik/ollm (PyPI ollm, commit 6d1705a). Reported via huntr's Model File Vulnerability program.

oLLM ships its own hand-rolled safetensors parser (SafeTensorReader) with zero header validation. model.safetensors is a 13-byte file whose header is not valid JSON. Loading it through the parser crashes the process with an uncaught json.JSONDecodeError, at model-load time, before any tensor data is read. This affects any app using ollm to load a model (its core use case — it streams models downloaded from the Hugging Face Hub).

pip install ollm — no GPU required, crash precedes any torch/CUDA op: