CVSS 3.0
7.5 highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2024-12886
High (7.5). EPSS 0.7% chance of exploitation in the next 30 days. Fixed in github.com/ollama/ollama 0.4.0-ci1.
An Out-Of-Memory (OOM) vulnerability exists in the `ollama` server version 0.3.14. This vulnerability can be triggered when a malicious API server responds with a gzip bomb HTTP response, leading to the `ollama` server crashing. The vulnerability is present in the `makeRequestWithRetry` and `getAuthorizationToken` functions, which use `io.ReadAll` to read the response body. This can result in excessive memory usage and a Denial of Service (DoS) condition.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
- CWE
- CWE-409
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-v464-r2r9-www7 | Go | github.com/ollama/ollama | <=0.3.14 | no fix published |
| GO-2025-3548 | Go | github.com/ollama/ollama | <0.4.0-ci1 | 0.4.0-ci1 |