Threats affecting pkg:github/ollama/ollama

CVE-2026-108836 is a server-side request forgery (SSRF) vulnerability in Ollama versions 0.34.0 and 0.34.1. The flaw exists in the IsValid function within the Pull API component, allowing remote attackers to manipulate requests. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). A public exploit disclosure exists. Upgrading to version 0.34.2 addresses the issue.

Ollama versions from 0.14.0 up to but not including 0.31.2 have an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism. This flaw allows attackers who can influence model output via prompt injection to append shell control operators to approved commands, enabling execution of additional shell commands without session approval. The vulnerability has a high severity with a CVSS score of 7.8.

CVE-2026-65315 is a high-severity vulnerability in Ollama's GGUF metadata parser that allows remote attackers to cause a server crash by uploading a crafted GGUF file. The flaw arises from uncontrolled memory allocation using attacker-controlled length and count fields without validation, leading to Go runtime out-of-memory fatal errors or panics that crash the server process.

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function readGGUFV1String reads a string length from untrusted GGUF metadata

An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.

Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint.

An Out-Of-Memory (OOM) vulnerability exists in the `ollama` server version 0.3.14. This vulnerability can be triggered when a malicious API server responds with a gzip bomb HTTP response, leading to the `ollama` server crashing. The vulnerability is present in the `makeRequestWithRetry` and `getAuthorizationToken` functions, which use `io.ReadAll` to read the response body. This can result in excessive memory usage and a Denial of Service (DoS) condition.

An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 bytes starting with the GGUF custom magic header. By leveraging a custom Modelfile that includes a FROM statement pointing to the attacker-controlled blob file, the attacker can crash the application through the CreateModel route, leading to a segmentation fault (signal SIGSEGV: segmentation violation).

extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.