CVE-2024-39721 is a denial-of-service vulnerability identified in Ollama versions prior to 0.1.34. The root cause lies in the CreateModelHandler function, which reads a file specified by the user via the req.Path parameter using the os.Open function. Since req.Path is user-controlled and not properly validated, an attacker can specify special device files such as /dev/random. Reading from /dev/random is a blocking operation that waits for sufficient entropy, causing the goroutine handling the request to block indefinitely. Even if the client aborts the HTTP request, the goroutine remains stuck, leading to resource exhaustion and potential denial of service. This vulnerability is classified under CWE-404 (Improper Resource Shutdown or Release). The CVSS v3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. No known exploits have been reported, and no official patches have been linked yet. The vulnerability primarily affects the availability of services running vulnerable Ollama versions and can be triggered remotely by unauthenticated attackers.

The primary impact of CVE-2024-39721 is a denial-of-service condition that can severely disrupt the availability of Ollama services. By causing goroutines to block indefinitely, an attacker can exhaust server resources such as CPU and memory, potentially leading to service crashes or degraded performance. This can interrupt critical operations relying on Ollama, affecting business continuity. Since the vulnerability does not affect confidentiality or integrity, data breaches or unauthorized data modifications are not a concern here. However, the ease of exploitation without authentication and the ability to trigger the issue remotely make it a significant risk for organizations exposing Ollama services to the internet. Large-scale or repeated exploitation could lead to widespread outages and increased operational costs due to recovery efforts.

To mitigate CVE-2024-39721, organizations should upgrade Ollama to version 0.1.34 or later where the issue is resolved. In the absence of an immediate patch, implement strict input validation and sanitization on the req.Path parameter to disallow special device files such as /dev/random and other blocking or sensitive system files. Employ rate limiting and request throttling to reduce the impact of repeated exploitation attempts. Monitor application logs and system metrics for signs of goroutine blocking or resource exhaustion. Additionally, consider isolating Ollama services behind firewalls or VPNs to restrict access to trusted users only. Implementing circuit breakers or timeouts on file read operations can also prevent indefinite blocking. Finally, maintain an incident response plan to quickly address denial-of-service conditions if they occur.