GitHub Advisoryadvisory · Go

GHSA-v464-r2r9-www7 Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIP

HIGH Published 2025-03-20 Modified 2025-03-21 Official page ↗
Aliases
CVE-2024-12886
Ecosystem
Go
Packages
github.com/ollama/ollama
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-409
Reviewed
2025-03-21

Affected packages

• Go github.com/ollama/ollama: <= 0.3.14 (no fix yet)

Description

An Out-Of-Memory (OOM) vulnerability exists in the `ollama` server version 0.3.14. This vulnerability can be triggered when a malicious API server responds with a gzip bomb HTTP response, leading to the `ollama` server crashing. The vulnerability is present in the `makeRequestWithRetry` and `getAuthorizationToken` functions, which use `io.ReadAll` to read the response body. This can result in excessive memory usage and a Denial of Service (DoS) condition.

Related

Alias · CVE (1)

  • CVE-2024-12886 An Out-Of-Memory (OOM) vulnerability exists in the `ollama` server version 0.3.14. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-409 Improper Handling of Highly Compressed Data (Data Amplification) weakness

References