A vulnerability in Ollama versions <=0.3.14 allows a malicious user to create a customized gguf model file that can be uploaded to the public Ollama server. When the server processes this malicious model, it crashes, leading to a Denial of Service (DoS) attack. The root cause of the issue is an out-of-bounds read in the gguf.go file.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/7b111d55-8215-4727-8807-c5ed4cf1bfbe | Exploit Third Party Advisory |
Configurations
History
13 May 2025, 13:28
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://huntr.com/bounties/7b111d55-8215-4727-8807-c5ed4cf1bfbe - Exploit, Third Party Advisory | |
| First Time |
Ollama ollama
Ollama |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:* |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-05-13 13:28
NVD link : CVE-2024-12055
Mitre link : CVE-2024-12055
JSON object : View
Products Affected
ollama
- ollama
CWE
CWE-125
Out-of-bounds Read