CVE-2025-0313

ollama: Improper Validation of Array Index in ollama/ollama

View on CVE.org
Published Mar 20, 2025 CVSS 3.0 · 7.5 High EPSS n/a KEV · Not listed
Description
** REJECT ** DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-12055. Notes: All CVE users should reference CVE-2024-12055 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-6819 ** REJECT ** DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-12055. Notes: All CVE users should reference CVE-2024-12055 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage.
History
Type Values Removed Values Added
Metrics threat_severity

Important

 threat_severity

None
Type Values Removed Values Added
Description A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to create a GGUF model that can cause a denial of service (DoS) attack. The vulnerability is due to improper validation of array index bounds in the GGUF model handling code, which can be exploited via a remote network. ** REJECT ** DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-12055. Notes: All CVE users should reference CVE-2024-12055 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage.
Title Improper Validation of Array Index in ollama/ollama ollama: Improper Validation of Array Index in ollama/ollama
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*
Vendors & Products Ollama
Ollama ollama
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}
Type Values Removed Values Added
First Time appeared Ollama
Ollama ollama
CPEs cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*
Vendors & Products Ollama
Ollama ollama
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to create a GGUF model that can cause a denial of service (DoS) attack. The vulnerability is due to improper validation of array index bounds in the GGUF model handling code, which can be exploited via a remote network.
Title Improper Validation of Array Index in ollama/ollama
Weaknesses CWE-129
References
Metrics cvssV3_0

{'score': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}
Earlier changes (2)
Weaknesses

Sources

Status
REJECTED
Assigner
@huntr_ai
Published
Updated
Apr 15, 2025, 3:56 PM
Reserved
Jan 7, 2025, 6:07 PM

View source JSON

Updated

JSON

Status
Rejected
Published
Mar 20, 2025, 10:15 AM
Modified
Apr 15, 2025, 4:15 PM

View source JSON

Severity
Public date
Mar 20, 2025, 10:11 AM

View source Bugzilla JSON

No data.