AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

OllamaGHSA-5jx5-hqx5-2vrj

Ollama DNS rebinding vulnerability

Ollama

CVE-2024-28224 · Published Apr 8, 2024 · updated Sep 10, 2026

High8.8
Fix: upgrade to 0.1.29 or later
GitHub advisory

Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).

Affected versions

PackageAffectedFixed in
github.com/ollama/ollama
Go
< 0.1.290.1.29
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-290, CWE-346, CWE-350
Also known as
CVE-2024-28224, GO-2024-2699

More Ollama advisories

All Ollama
High 7.5Mar 20, 2025Ollama Divide by Zero VulnerabilityCVE-2024-8063no fix yetHigh 7.5Mar 20, 2025Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIPCVE-2024-12886no fix yetHigh 7.5Mar 20, 2025Ollama Allows Out-of-Bounds ReadCVE-2024-12055no fix yetHigh 8.2Oct 31, 2024Ollama Out-of-bounds ReadCVE-2024-39720fixed in 0.1.46High 7.5Aug 29, 2024Ollama can extract members of a ZIP archive outside of the parent directoryCVE-2024-45436fixed in 0.1.47MediumMay 31, 2024Ollama does not validate the format of the digest (sha256 with 64 hex digits)CVE-2024-37032fixed in 0.1.34