Ollama vulnerabilities

Critical authentication bypass vulnerability in Ollama platform's API endpoints up to v0.12.3. Multiple API endpoints are exposed without authentication, allowing remote attackers to perform unauthorized model management operations.

Ollama (HEAD f0078ae) has an uncontrolled memory allocation vulnerability in the GGUF metadata parser. A remote attacker can upload a crafted sub-1KB GGUF file via the blob upload and model create/pull APIs, triggering an unrecoverable Go runtime out-of-memory fatal error or makeslice panic that bypasses recovery middleware and crashes the entire server.

A vulnerability in the downloadBlob function in Ollama allows a remote attacker to cause a denial-of-service (DoS) condition without authentication. The issue stems from improper validation of user-supplied data, leading to an out-of-bounds memory access.

An unauthenticated remote attacker can read and exfiltrate the heap memory of the Ollama server through the model quantization engine, leading to sensitive data exposure.

Ollama up to version 0.18.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the Model Pull API component (file server/download.go). An attacker can remotely manipulate the request, leading to requests being sent to internal resources.

Ollama versions 0.11.5-rc0 through 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality. When processing base64-encoded image data via the /api/chat endpoint, the application fails to validate that the decoded data represents valid media before passing it to the mtmd_helper_bitmap_init_from_buf function. This function can return NULL for malformed input, but the code does not check this return value before dereferencing the pointer in subsequent operations.