-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from GetBlobsPath in modelpath.go handling digest inputs without proper validation. The commit adds regex validation (^sha256[:-][0-9a-fA-F]{64}$) to this function, and the test cases show it previously allowed: 1) short/long digests 2) ../ prefixes 3) non-hex characters. The CVE description specifically mentions TestGetBlobsPath test case failures related to these patterns, confirming this was the entry point for invalid digest handling.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/ollama/ollama | go | < 0.1.34 | 0.1.34 |