CVE-2024-12886

🗓️ 20 Mar 2025 10:10:28Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 85 Views🌐 WEB

Out-Of-Memory vulnerability in ollama server version 0.3.14 can cause Denial of Service attack.

Reporter	Title	Published	Views	Family All 24
zdt	Ollama 0.5.11 Denial of Service Exploit	20 Feb 202500:00	–	zdt
Circl	CVE-2024-12886	20 Feb 202520:00	–	circl
CNNVD	Ollama 资源管理错误漏洞	20 Mar 202500:00	–	cnnvd
Cvelist	CVE-2024-12886 Out-Of-Memory (OOM) Vulnerability in ollama/ollama	20 Mar 202510:10	–	cvelist
EUVD	EUVD-2025-6985	3 Oct 202520:07	–	euvd
Huntr	Ollama server is vulnerable to OOM DoS attacks when using `makeRequestWithRetry` and `getAuthorizationToken` functions	31 Oct 202421:19	–	huntr
Github Security Blog	Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIP	20 Mar 202512:32	–	github
NVD	CVE-2024-12886	20 Mar 202510:15	–	nvd
Tenable Nessus	Ollama <= 0.3.14 Multiple Vulnerabilities	28 Mar 202500:00	–	nessus
OPENSUSE Linux	govulncheck-vulndb-0.0.20250331T171002-1.1 on GA media (moderate)	3 Apr 202500:00	–	opensuse

[
  {
    "vendor": "ollama",
    "product": "ollama/ollama",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/f115fe52-58af-4844-ad29-b1c25f7245df

Parameter	Position	Path	Description	CWE
sha256	binary	api/blobs/sha256:{sha256}	Upload of a crafted GGUF model via binary body to trigger memory exhaustion in Ollama during blob upload.	CWE-409, CWE-400
model	request body	api/create	Creation of a model from a malicious GGUF payload uploaded previously, enabling remote DoS via crafted model creation.	CWE-409, CWE-400
files	request body	api/create	Creation of a model from a malicious GGUF payload uploaded previously, enabling remote DoS via crafted model creation.	CWE-409, CWE-400

17 Jun 2026 07:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 37.5

EPSS0.00677

SSVC