PT-2024-9416 · Ollama · Ollama

Published

2024-10-30

·

Updated

2025-05-13

·

CVE-2024-39721

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions: Ollama versions prior to 0.1.34
Description: The issue is related to an uncontrolled consumption of resources in Ollama. It is caused by the CreateModelHandler function using os.Open to read a file until completion, where the req.Path parameter is user-controlled and can be set to /dev/random, leading to a blocking condition that causes the goroutine to run infinitely, even after the HTTP request is aborted by the client. This can allow a remote attacker to cause a denial of service.
Recommendations: For Ollama versions prior to 0.1.34, update to version 0.1.34 to patch this flaw. As a temporary workaround, consider restricting access to the CreateModelHandler function or avoiding the use of the req.Path parameter with /dev/random input to minimize the risk of exploitation.

Exploit

Fix

Resource Exhaustion

Improper Resource Release

Weakness Enumeration

Related Identifiers

BDU:2024-11111
CVE-2024-39721

Affected Products

Ollama