AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

OllamaGHSA-v464-r2r9-www7

Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIP

Ollama

CVE-2024-12886 · Published Mar 20, 2025 · updated Mar 31, 2025

High7.5
No fix yet
GitHub advisory

An Out-Of-Memory (OOM) vulnerability exists in the ollama server version 0.3.14. This vulnerability can be triggered when a malicious API server responds with a gzip bomb HTTP response, leading to the ollama server crashing. The vulnerability is present in the makeRequestWithRetry and getAuthorizationToken functions, which use io.ReadAll to read the response body. This can result in excessive memory usage and a Denial of Service (DoS) condition.

Affected versions

PackageAffectedFixed in
github.com/ollama/ollama
Go
<= 0.3.14No fix yet
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-400, CWE-409
Also known as
CVE-2024-12886, GO-2025-3548

More Ollama advisories

All Ollama