{"id":"CVE-2024-28224","aliases":["EUVD-2024-1103","GHSA-5jx5-hqx5-2vrj","GO-2024-2699"],"status":"published","title":"Ollama DNS rebinding vulnerability","description":"Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).","severity":{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00354,"percentile":0.29534,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-290","CWE-346","CWE-350"],"published":"2024-04-08T00:00:00Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"Go","package":"github.com/ollama/ollama","fixed_in":["0.1.29"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/jmorganca/ollama","fixed_in":["0.1.29"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/ollama/ollama","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.29"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/ollama/ollama","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.29"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/jmorganca/ollama","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.29"}]}]}],"products":[{"vendor":"ollama","product":"ollama"}],"references":[{"url":"https://www.nccgroup.trust/us/our-research/?research=Technical+advisories","tags":["x_transferred","Broken Link","advisory","web"]},{"url":"https://github.com/ollama/ollama/releases","tags":["x_transferred","Release Notes","package","web"]},{"url":"https://research.nccgroup.com/2024/04/08/technical-advisory-ollama-dns-rebinding-attack-cve-2024-28224/","tags":["x_transferred","Not Applicable","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28224","tags":["advisory"]},{"url":"https://research.nccgroup.com/2024/04/08/technical-advisory-ollama-dns-rebinding-attack-cve-2024-28224","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2699","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5jx5-hqx5-2vrj","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28224.json","tags":["advisory"]},{"url":"https://github.com/ollama/ollama","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-28224","description":"Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).","status":"published","published":"2024-04-08T00:00:00Z","modified":"2025-03-26T20:00:51.47Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:34:18.951288Z"}],"euvd":[{"id":"EUVD-2024-1103","description":"Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).","status":"published","published":"2024-04-08T00:00:00Z","modified":"2025-03-26T20:00:51Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T20:52:50.381676Z"}],"ghsa":[{"id":"GHSA-5jx5-hqx5-2vrj","title":"Ollama DNS rebinding vulnerability","description":"Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).","status":"published","published":"2024-04-08T21:31:16Z","modified":"2025-03-27T17:42:19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-290","CWE-346","CWE-350"],"updated_at":"2026-11-02T14:38:36.51789Z"}],"nvd":[{"id":"CVE-2024-28224","description":"Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).","status":"published","published":"2024-04-08T19:15:07.353Z","modified":"2026-06-17T07:21:12.873Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:09:48.152273Z"}],"osv":[{"id":"CVE-2024-28224","description":"Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).","status":"published","published":"2024-04-08T00:00:00Z","modified":"2026-10-28T02:30:59.122887763Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:39.569658Z"},{"id":"GHSA-5jx5-hqx5-2vrj","title":"Ollama DNS rebinding vulnerability","description":"Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).","status":"published","published":"2024-04-08T21:31:16Z","modified":"2026-09-10T03:49:18.786132455Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-290","CWE-346","CWE-350"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"GO-2024-2699","title":"Ollama DNS rebinding vulnerability in github.com/jmorganca/ollama","description":"Ollama DNS rebinding vulnerability in github.com/jmorganca/ollama","status":"published","published":"2024-06-10T16:38:54Z","modified":"2026-02-04T02:40:59.930741Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}