CVE-2025-44779

An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull...

CVE-2024-39720

An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 bytes starting with the GGUF custom magic header. By leveraging a custom Modelfile that includes a FROM statement pointing to the attacker-controlled blob file,...

CVE-2024-39720

The Ollama application (versions prior to 0.1.46 ) is vulnerable to a crash via a segmentation fault (signal SIGSEGV ) in the CreateModel route. An attacker can trigger this by using two HTTP requests to upload a malformed GGUF file—containing only 4 bytes with the GGUF custom magic header—and th...