Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-12886

CVE-2024-12886: Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIP

7.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2024-12886
GHSA ID
GHSA-v464-r2r9-www7
EPSS Score
0.19664%
CWE
CWE-400
Published
3/20/2025
Updated
3/21/2025
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/ollama/ollamago

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability description explicitly names both functions as using io.ReadAll for response body handling. io.ReadAll is a well-known anti-pattern for processing untrusted HTTP responses as it reads the entire body into memory without size restrictions. When processing gzip-encoded responses (which can have extreme compression ratios), this leads to uncontrolled memory allocation. The advisory's technical details and CWE-400 classification directly align with this pattern. File paths are inferred based on Go project conventions since explicit path information wasn't provided in the advisory.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n Out-O*-M*mory (OOM) vuln*r**ility *xists in t** `oll*m*` s*rv*r v*rsion *.*.**. T*is vuln*r**ility **n ** tri***r** w**n * m*li*ious *PI s*rv*r r*spon*s wit* * *zip *om* *TTP r*spons*, l***in* to t** `oll*m*` s*rv*r *r*s*in*. T** vuln*r**ility is

Reasoning

T** vuln*r**ility **s*ription *xpli*itly n*m*s *ot* `*un*tions` *s usin* `io.R****ll` *or r*spons* *o*y **n*lin*. `io.R****ll` is * w*ll-known *nti-p*tt*rn *or pro**ssin* untrust** `*TTP` r*spons*s *s it r***s t** *ntir* *o*y into m*mory wit*out siz*