AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

OllamaGHSA-8hqg-whrw-pv92

Ollama does not validate the format of the digest (sha256 with 64 hex digits)

Ollama

CVE-2024-37032 · Published May 31, 2024 · updated Sep 10, 2026

Medium
Fix: upgrade to 0.1.34 or later
GitHub advisory

Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.

Affected versions

PackageAffectedFixed in
github.com/ollama/ollama
Go
< 0.1.340.1.34
Details and references

More Ollama advisories

All Ollama