x/vulndb: potential Go vuln in github.com/ollama/ollama: GHSA-9gcr-28rp-cc24

[GoVulnBot]

Advisory GHSA-9gcr-28rp-cc24 references a vulnerability in the following Go modules:

Module
github.com/ollama/ollama

Description:
A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to upload and create a customized GGUF model file on the Ollama server. This can lead to a division by zero error in the ggufPadding function, causing the server to crash and resulting in a Denial of Service (DoS) attack.

References:

• ADVISORY: GHSA-9gcr-28rp-cc24
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2025-0317
• WEB: https://huntr.com/bounties/a9951bca-9bd8-49b2-b143-4cd4219f9fa0

Cross references:

• github.com/ollama/ollama appears in 3 other report(s):
  • data/reports/GO-2024-2901.yaml (x/vulndb: potential Go vuln in github.com/ollama/ollama: CVE-2024-37032 #2901)
  • data/reports/GO-2024-3104.yaml (x/vulndb: potential Go vuln in github.com/ollama/ollama: CVE-2024-45436 #3104)
  • data/reports/GO-2024-3245.yaml (x/vulndb: potential Go vuln in github.com/ollama/ollama: CVE-2024-39720 #3245)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/ollama/ollama
      vulnerable_at: 0.6.2
summary: Ollama Divide By Zero vulnerability in github.com/ollama/ollama
cves:
    - CVE-2025-0317
ghsas:
    - GHSA-9gcr-28rp-cc24
references:
    - advisory: https://github.com/advisories/GHSA-9gcr-28rp-cc24
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-0317
    - web: https://huntr.com/bounties/a9951bca-9bd8-49b2-b143-4cd4219f9fa0
source:
    id: GHSA-9gcr-28rp-cc24
    created: 2025-03-22T01:01:24.088549736Z
review_status: UNREVIEWED

[thatnealpatel]

GHSA lists no published patch.

[gopherbot]

Change https://go.dev/cl/661355 mentions this issue: data/reports: add 4 reports