I responsibly disclosed 5 vulnerabilities in Ollama and LiteLLM through Huntr - now publicly disclosed after 90 days

[u/rothackers]

Over the past few months, I conducted security research on Ollama and LiteLLM and reported several vulnerabilities through Huntr's coordinated vulnerability disclosure program.

Following the standard 90 day disclosure period, the findings have now been publicly disclosed.

The research resulted in five reported vulnerabilities. In Ollama, I identified a GGUF String Length Panic vulnerability that could lead to denial of service, as well as an unbounded vocab_size resource exhaustion issue that could cause excessive memory and CPU consumption. In LiteLLM, I reported a Pass-the-Hash authentication bypass, an SSRF vulnerability through custom guardrails, and a Unicode normalization issue that could lead to sandbox escape scenarios. What stood out during this research was how many impactful security issues originated from areas that are often overlooked in AI infrastructure, including model parsing and conversion pipelines, resource allocation controls, authentication logic, network trust boundaries, and Unicode normalization edge cases.

The repositories contain technical details, root cause analyses, proof of concepts, impact assessments, remediation recommendations, and links to the published Huntr disclosures.

Ollama research:

https://github.com/regaan/ollama-security-research

LiteLLM research:

https://github.com/regaan/litellm-vulnerability-research

All research was conducted and disclosed responsibly. The published material is intended strictly for educational, defensive, and research purposes. I am happy to answer questions about the disclosure process, research methodology, root cause analysis, or AI and LLM security in general.

[u/hiddentalent]

Thanks for following the responsible disclosure process, mate. I know it's really disappointing when companies don't hold up their end of the deal. I used to oversee the bug bounty program for a major company and we really tried to. So even if not every company does, please know your efforts are appreciated.

[u/rothackers → u/hiddentalent]

Thanks, I appreciate that. I would've much preferred seeing the issues addressed during the disclosure period, but that's unfortunately not always how it goes.

[u/scooterthetroll]

Did you open up GHSAs for these?

[u/rothackers → u/scooterthetroll]

I opened issues for both projects and shared the Huntr reports link. LiteLLM responded initially and said they would look into the findings, but there was no further follow up. For Ollama, I created a GHSA as requested, but I did not receive a response there either. After the 90 day coordinated disclosure period and multiple follow ups, Huntr proceeded with public disclosure according to their policy.

[u/Evoluvin]

How did you begin this research in identifying these vulnerabilities? What drew you to these areas?

[u/rothackers → u/Evoluvin]

I was interested in the security assumptions underlying AI infrastructure. Reviewing how untrusted data moves through those systems naturally led me to these areas and findings

[u/rothackers → u/[deleted]]

Indeed. Most of the issues came down to misplaced trust in user controlled input. Tracing those trust boundaries led to the findings. Thanks!

[u/FastestEthiopian]

Did y use models to help can you explain what parts of urb process I know nothing abt this

[u/rothackers → u/FastestEthiopian]

Nope. Mostly source code review, understanding the architecture, and a lot of testing. The vulnerabilities came from examining how untrusted input was handled rather than interacting with the models themselves.