PT-2025-12311 · Ollama · Ollama

Published 2025-03-20 · Updated 2025-04-02 · CVE-2025-0315

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ollama/ollama versions 0.3.14 and earlier

Description A malicious user can create a customized GGUF model file, upload it to the Ollama server, and create it, causing the server to allocate unlimited memory. This leads to a Denial of Service (DoS) attack.

Recommendations For versions 0.3.14 and earlier, consider restricting access to the model file upload feature to prevent malicious users from uploading customized GGUF model files until a patch is available. As a temporary workaround, monitor server memory allocation closely to detect and mitigate potential DoS attacks.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-0315

GHSA-FCCC-8M69-8R78

GO-2025-3557

OPENSUSE-SU-2025:14955-1

Affected Products

Ollama

References · 17

• 🔥 https://huntr.com/bounties/da414d29-b55a-496f-b135-17e0fcec67bc · Exploit
• https://osv.dev/vulnerability/GO-2025-3557 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fccc-8m69-8r78 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0315 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:14955-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-0315 · Vendor Advisory
• https://github.com/ollama/ollama · Note
• https://suse.com/security/cve/CVE-2024-12886 · Note
• https://twitter.com/CVEnew/status/1902968869888856454 · Twitter Post
• https://t.me/latest_high_impact_cve/2009 · Telegram Post
• https://github.com/advisories/GHSA-fccc-8m69-8r78 · Note
• https://t.me/cvedetector/20720 · Telegram Post
• https://t.me/cvetracker/19517 · Telegram Post
• https://lists.opensuse.org/archives/list/[e-mail]/thread/GT5JSN3VXOPFJR5R2YOR4UYXCVU3UJDI · Note
• https://suse.com/security/cve/CVE-2024-12055 · Note