CVE-2024-39720 Ollama Out-of-bounds Read
An attacker can crash the Ollama server by uploading a malformed GGUF file and referencing it in a custom Modelfile, causing a segmentation fault.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-39720?
CVE-2024-39720 is a high-severity denial of service vulnerability in n/a, published on 31 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 bytes starting with the GGUF custom magic header. By leveraging a custom Modelfile that includes a FROM statement pointing to the attacker-controlled blob file, the attacker can crash the application through the CreateModel route, leading to a segmentation fault (signal SIGSEGV: segmentation violation).
Weakness: CWE-125
Which versions are affected by CVE-2024-39720?
3 open source packages ship an affected version, including github.com/ollama/ollama. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ollama/ollama Go | All versions | 0.1.46 |
github.com/ollama/ollama Go | All versions | 0.1.46 |
github.com/ollama/ollama Go | All versions | 0.1.46 |
Products include Ollama Ollama.
How do I fix CVE-2024-39720?
Upgrade github.com/ollama/ollama to 0.1.46 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-39720 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-39720 exists.
Other vulnerabilities in n/a
- CVE-2025-63389 Ollama Platform has missing authentication enabling attackers to perform model management operations
- CVE-2024-45436 Ollama can extract members of a ZIP archive outside of the parent directory
- CVE-2026-7482 Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers
- CVE-2024-37032 Ollama does not validate the format of the digest (sha256 with 64 hex digits)
- CVE-2025-15514 Ollama Multi-Modal Model Image Processing NULL Pointer Dereference
Sources
Also known as GHSA-95j2-w8x7-hm88, GO-2024-3245.