x/vulndb: potential Go vuln in github.com/ollama/ollama: GHSA-fccc-8m69-8r78

[GoVulnBot]

Advisory GHSA-fccc-8m69-8r78 references a vulnerability in the following Go modules:

Module
github.com/ollama/ollama

Description:
A vulnerability in ollama/ollama <=0.3.14 allows a malicious user to create a customized GGUF model file, upload it to the Ollama server, and create it. This can cause the server to allocate unlimited memory, leading to a Denial of Service (DoS) attack.

References:

• ADVISORY: GHSA-fccc-8m69-8r78
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2025-0315
• WEB: https://huntr.com/bounties/da414d29-b55a-496f-b135-17e0fcec67bc

Cross references:

• github.com/ollama/ollama appears in 3 other report(s):
  • data/reports/GO-2024-2901.yaml (x/vulndb: potential Go vuln in github.com/ollama/ollama: CVE-2024-37032 #2901)
  • data/reports/GO-2024-3104.yaml (x/vulndb: potential Go vuln in github.com/ollama/ollama: CVE-2024-45436 #3104)
  • data/reports/GO-2024-3245.yaml (x/vulndb: potential Go vuln in github.com/ollama/ollama: CVE-2024-39720 #3245)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/ollama/ollama
      vulnerable_at: 0.6.2
summary: Ollama Allocation of Resources Without Limits or Throttling vulnerability in github.com/ollama/ollama
cves:
    - CVE-2025-0315
ghsas:
    - GHSA-fccc-8m69-8r78
references:
    - advisory: https://github.com/advisories/GHSA-fccc-8m69-8r78
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-0315
    - web: https://huntr.com/bounties/da414d29-b55a-496f-b135-17e0fcec67bc
source:
    id: GHSA-fccc-8m69-8r78
    created: 2025-03-22T00:01:21.902975592Z
review_status: UNREVIEWED

[thatnealpatel]

GHSA lists no published patch.

[gopherbot]

Change https://go.dev/cl/661355 mentions this issue: data/reports: add 4 reports