High severity7.5NVD Advisory· Published Mar 20, 2025· Updated Jun 17, 2026
CVE-2024-12055
CVE-2024-12055
Description
A vulnerability in Ollama versions <=0.3.14 allows a malicious user to create a customized gguf model file that can be uploaded to the public Ollama server. When the server processes this malicious model, it crashes, leading to a Denial of Service (DoS) attack. The root cause of the issue is an out-of-bounds read in the gguf.go file.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/ollama/ollamaGo | <= 0.3.14 | — |
Affected products
9- osv-coords7 versionspkg:apk/chainguard/k8sgptpkg:apk/chainguard/modspkg:apk/chainguard/ollama-fipspkg:apk/wolfi/k8sgptpkg:apk/wolfi/modspkg:golang/github.com/ollama/ollamapkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed
< 0+ 6 more
- (no CPE)range: < 0
- (no CPE)range: < 1.8.1-r14
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 1.8.1-r14
- (no CPE)range: <= 0.3.14
- (no CPE)range: < 0.0.20250331T171002-1.1
Patches
Vulnerability mechanics
References
3- huntr.com/bounties/7b111d55-8215-4727-8807-c5ed4cf1bfbenvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-89qx-m49c-8crfghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-12055ghsaADVISORY
News mentions
0No linked articles in our index yet.