CVE-2024-12886
Out-Of-Memory (OOM) Vulnerability in ollama/ollama
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Out-Of-Memory (OOM) Vulnerability in ollama/ollama
An Out-Of-Memory (OOM) vulnerability exists in the `ollama` server version 0.3.14. This vulnerability can be triggered when a malicious API server responds with a gzip bomb HTTP response, leading to the `ollama` server crashing. The vulnerability is present in the `makeRequestWithRetry` and `getAuthorizationToken` functions, which use `io.ReadAll` to read the response body. This can result in excessive memory usage and a Denial of Service (DoS) condition.
Reserved 2024-12-20 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_aiCWE-400 Uncontrolled Resource Consumption
huntr.com/bounties/f115fe52-58af-4844-ad29-b1c25f7245df
Support options
