PYSEC-2025-145

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/ollama/PYSEC-2025-145.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2025-145

Aliases

Published

2025-05-16T09:15:17.980Z

Modified

2026-05-21T15:00:20.810535019Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by customizing the manifest content and spoofing a service. This is due to improper validation of array index access when downloading a model via the /api/pull endpoint, which can lead to a server crash.

References

https://huntr.com/bounties/921ba5d4-f1d0-4c66-9764-4f72dffe7acd

Affected packages

PyPI / ollama

Package

Name: ollama; View open source insights on deps.dev
Purl: pkg:pypi/ollama

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.5.11

Affected versions

0.*

0.0.0

0.0.1

0.1.0

0.1.2

0.1.3

0.1.4

0.1.5

0.1.6

0.1.7

0.1.8

0.1.9

0.2.0

0.2.1

0.3.0

0.3.1

0.3.2

0.3.3

0.4.0

0.4.1

0.4.2

0.4.3

0.4.4

0.4.5

0.4.6

0.4.7

0.4.8

0.4.9

0.5.0

0.5.1

0.5.2

0.5.3

0.5.4

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/ollama/PYSEC-2025-145.yaml"