CVE-2025-1975CWE-129

Improper Validation of Array Index in ollama/ollama

High · published May 16, 2025

CVSS v3.0
7.5
EPSS
1%
Percentile
43.4
In the wild
Unconfirmed
What it is

A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by customizing the manifest content and spoofing a service. This is due to improper validation of array index access when downloading a model via the /api/pull endpoint, which can lead to a server crash.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00521 · 43.4th percentile
Weakness
CWE-129 · Improper Validation of Array Index
Published
2025-05-16T08:25Z
EPSS history
Timeline
  • 16 MAY 08:25Z
    Improper Validation of Array Index in ollama/ollama
    cvelistv5