cve.bz

CVE-2024-37032

8.8 highEPSS 90%

High (8.8) in ollama ollama. EPSS 90% chance of exploitation in the next 30 days. Fixed in github.com/ollama/ollama 0.1.34.

Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.

Severity

CVSS 3.1

8.8 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
90% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE
CWE-22
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-8hqg-whrw-pv92Gogithub.com/ollama/ollama<0.1.340.1.34
GO-2024-2901Gogithub.com/ollama/ollama<0.1.340.1.34

References

Check your stackJSON