OllamaGHSA-8hqg-whrw-pv92
Ollama does not validate the format of the digest (sha256 with 64 hex digits)
MediumCVE-2024-37032 · Published May 31, 2024 · updated Sep 10, 2026
Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial `../` substring.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/ollama/ollama Go | < 0.1.34 | 0.1.34 |
Details and references
- Severity from
- GitHub (reviewed advisory)
- Also known as
- CVE-2024-37032, GO-2024-2901
- nvd.nist.gov/vuln/detail/CVE-2024-37032
- github.com/ollama/ollama/pull/4175
- github.com/ollama/ollama/commit/2a21363bb756a7341d3d577f098583865bd7603f
- github.com/advisories/GHSA-8hqg-whrw-pv92
- github.com/ollama/ollama
- github.com/ollama/ollama/blob/adeb40eaf29039b8964425f69a9315f9f1694ba8/server/modelpath_test.go#L41-L58
- github.com/ollama/ollama/compare/v0.1.33...v0.1.34
- pkg.go.dev/vuln/GO-2024-2901
- www.vicarius.io/vsociety/posts/probllama-in-ollama-a-tale-of-a-yet-another-rce-vulnerability-cve-2024-37032
More Ollama advisories
All Ollama| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 202025 | Ollama Divide by Zero Vulnerability High7.5Mar 20, 2025 | High7.5 | No fix yet |
| Mar 202025 | Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIPHigh7.5Mar 20, 2025 | High7.5 | No fix yet |
| Mar 202025 | Ollama Allows Out-of-Bounds ReadHigh7.5Mar 20, 2025 | High7.5 | No fix yet |
| Oct 312024 | Ollama Out-of-bounds ReadHigh8.2Oct 31, 2024 | High8.2 | 0.1.46 |
| Aug 292024 | Ollama can extract members of a ZIP archive outside of the parent directoryHigh7.5Aug 29, 2024 | High7.5 | 0.1.47 |
| Apr 82024 | Ollama DNS rebinding vulnerabilityHigh8.8Apr 8, 2024 | High8.8 | 0.1.29 |