Ollama vulnerabilities

Products

• Ollama 32
• Ollama/ollama 7

Newest

• ollama Ollama Pull API name.go IsValid server-side request forgery CVE-2026-108836 6.9 MediumOctober 12, 2026
• ollama Path Traversal leading to Remote Code Execution in Ollama CVE-2026-103663 Public exploit 6.9 MediumOctober 8, 2026
• ollama Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization CVE-2026-102697 Public exploit 8.5 HighSeptember 29, 2026
• ollama Ollama GGUF Decoder gguf.go readGGUFV1String integer overflow CVE-2026-86289 5.3 MediumSeptember 7, 2026
• ollama Ollama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect CVE-2026-85180 8.7 HighSeptember 3, 2026
• ollama Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser CVE-2026-65315 8.7 HighJuly 21, 2026
• ollama Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability CVE-2026-15685 7.5 HighJuly 13, 2026
• ollama There exists an unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine CVE-2026-5757 7.5 HighJune 26, 2026
• ollama Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers CVE-2026-7482 Public exploitFix available 8.8 HighMay 4, 2026
• ollama Remote Code Execution in Ollama via Update Mechanism CVE-2026-42249 Public exploit 7.7 HighApril 29, 2026
• ollama Missing Signature Verification for Updates in Ollama CVE-2026-42248 Public exploit 7.7 HighApril 29, 2026
• ollama Ollama Tensor Model Transfer transfer.go digestToPath path traversal CVE-2026-7020 Public exploit 6.3 MediumApril 26, 2026
• ollama Ollama Model Pull API download.go server-side request forgery CVE-2026-5530 Public exploit 5.3 MediumApril 5, 2026
• ollama An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs... CVE-2025-66960 7.5 HighJanuary 21, 2026
• ollama An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF... CVE-2025-66959 7.5 HighJanuary 21, 2026
• ollama, red hat ansible automation platform 2, openshift ai (rhoai) +2 more Ollama Multi-Modal Model Image Processing NULL Pointer Dereference CVE-2025-15514 8.7 HighJanuary 12, 2026
• ollama Ollama Platform has missing authentication enabling attackers to perform model management operations CVE-2025-63389 9.8 CriticalDecember 18, 2025
• ollama Ollama allows deletion of arbitrary files CVE-2025-44779 Fix available 6.6 MediumAugust 7, 2025
• ollama Ollama vulnerable to Cross-Domain Token Exposure CVE-2025-51471 Public exploit EPSS 18.5% 6.9 MediumJuly 22, 2025
• ollama, ollama ollama/ollama +1 more Improper Validation of Array Index in ollama/ollama CVE-2025-1975 7.5 HighMay 16, 2025
• ollama, ollama ollama/ollama +1 more Divide by Zero in ollama/ollama CVE-2024-8063 7.5 HighMarch 20, 2025
• ollama, ollama ollama/ollama +1 more NULL Pointer Dereference in ollama/ollama CVE-2025-0312 7.5 HighMarch 20, 2025
• ollama ollama/ollama Out-Of-Memory (OOM) Vulnerability in ollama/ollama CVE-2024-12886 Public exploitFix available 7.5 HighMarch 20, 2025
• ollama, ollama ollama/ollama +1 more Divide By Zero in ollama/ollama CVE-2025-0317 EPSS 14.5% 7.5 HighMarch 20, 2025
• ollama, ollama ollama/ollama +1 more Allocation of Resources Without Limits or Throttling in ollama/ollama CVE-2025-0315 7.5 HighMarch 20, 2025
• ollama, ollama ollama/ollama +1 more DoS using malicious gguf model file in ollama/ollama CVE-2024-12055 7.5 HighMarch 20, 2025
• ollama An issue was discovered in Ollama before 0.1.46. It exposes which files exist on the server on... CVE-2024-39722 Public exploit 7.5 HighOctober 31, 2024
• ollama An issue was discovered in Ollama before 0.1.34. The CreateModelHandler function uses os.Open to... CVE-2024-39721 7.5 HighOctober 31, 2024
• ollama Ollama Out-of-bounds Read CVE-2024-39720 Fix available 8.2 HighOctober 31, 2024
• ollama An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api... CVE-2024-39719 Public exploit 7.5 HighOctober 31, 2024
• ollama Ollama can extract members of a ZIP archive outside of the parent directory CVE-2024-45436 Public exploitFix available 7.5 HighAugust 29, 2024
• ollama Ollama does not validate the format of the digest (sha256 with 64 hex digits) CVE-2024-37032 Public exploitFix available EPSS 89.6% 8.8 HighMay 31, 2024
• ollama Ollama DNS rebinding vulnerability CVE-2024-28224 Fix available 6.6 MediumApril 8, 2024