Ollama security advisories
16 advisories · 2 critical or high in 12 months · latest May 4
16 advisories
| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 4 | Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader CVE-2026-7482High9.1fixed in 0.17.1 | High9.1 | 0.17.1 |
| Apr 26 | Ollama is Vulnerable to Path Traversal CVE-2026-7020Low5.6no fix yet | Low5.6 | No fix yet |
| Dec 182025 | Ollama Platform has missing authentication enabling attackers to perform model management operations CVE-2025-63389Criticalno fix yet | Critical | No fix yet |
| Aug 72025 | Ollama allows deletion of arbitrary files CVE-2025-44779Medium6.6fixed in 0.1.34 | Medium6.6 | 0.1.34 |
| Jul 222025 | Ollama vulnerable to Cross-Domain Token Exposure CVE-2025-51471Medium6.9no fix yet | Medium6.9 | No fix yet |
| May 162025 | Ollama Server Vulnerable to Denial of Service (DoS) Attack CVE-2025-1975High7.5no fix yet | High7.5 | No fix yet |
| Mar 202025 | Ollama Divide By Zero vulnerability CVE-2025-0317High7.5no fix yet | High7.5 | No fix yet |
| Mar 202025 | Ollama Allocation of Resources Without Limits or Throttling vulnerability CVE-2025-0315High7.5no fix yet | High7.5 | No fix yet |
| Mar 202025 | Ollama Denial of Service (DoS) via Null Pointer Dereference CVE-2025-0312High7.5no fix yet | High7.5 | No fix yet |
| Mar 202025 | Ollama Divide by Zero Vulnerability CVE-2024-8063High7.5no fix yet | High7.5 | No fix yet |
| Mar 202025 | Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIP CVE-2024-12886High7.5no fix yet | High7.5 | No fix yet |
| Mar 202025 | Ollama Allows Out-of-Bounds Read CVE-2024-12055High7.5no fix yet | High7.5 | No fix yet |
| Oct 312024 | Ollama Out-of-bounds Read CVE-2024-39720High8.2fixed in 0.1.46 | High8.2 | 0.1.46 |
| Aug 292024 | Ollama can extract members of a ZIP archive outside of the parent directory CVE-2024-45436High7.5fixed in 0.1.47 | High7.5 | 0.1.47 |
| May 312024 | Ollama does not validate the format of the digest (sha256 with 64 hex digits) CVE-2024-37032Mediumfixed in 0.1.34 | Medium | 0.1.34 |
| Apr 82024 | Ollama DNS rebinding vulnerability CVE-2024-28224High8.8fixed in 0.1.29 | High8.8 | 0.1.29 |
About Ollama
Run open models locally.
Packages watched: github.com/ollama/ollama (Go).
Ollama elsewhere on fru.dev: Funding · Paydays · Releases · Repos