The version of Ollama installed on the remote host is prior or equal to 0.3.14. It is, therefore, affected by multiple vulnerabilities, including the following:

  - A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to upload and create a customized     GGUF model file on the Ollama server. This can lead to a division by zero error in the ggufPadding     function, causing the server to crash and resulting in a Denial of Service (DoS) attack. (CVE-2025-0317)     
  - A vulnerability in ollama/ollama <=0.3.14 allows a malicious user to create a customized GGUF model file,     upload it to the Ollama server, and create it. This can cause the server to allocate unlimited memory,     leading to a Denial of Service (DoS) attack. (CVE-2025-0315)

  - A vulnerability in Ollama versions <=0.3.14 allows a malicious user to create a customized gguf model     file that can be uploaded to the public Ollama server. When the server processes this malicious model,     it crashes, leading to a Denial of Service (DoS) attack. The root cause of the issue is an out-of-bounds     read in the gguf.go file. (CVE-2024-12055)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ollama <= 0.3.14 Multiple Vulnerabilities

high Nessus Plugin ID 233434

Version 1.1