LLM frameworks · Ollama
Ollama
Run open-weight models locally behind an HTTP API.
3Advisories
1critical
2high
0medium
2026-05-04Latest
Timeline · advisories per quarter
12024 Q2
12025 Q4
12026 Q2
Named in sources
Reported for Ollama
01. CVE-2025-63389: Ollama Platform has missing authentication enabling attackers to perform model management operationsA critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations. Ollama 2025-12-18 02. CVE-2026-7482: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loaderOllama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. Ollama 2026-05-04 03. CVE-2024-28224: Ollama DNS rebinding vulnerabilityOllama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion). Ollama 2024-04-08
Ollama 2025-12-18 02. CVE-2026-7482: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loaderOllama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. Ollama 2026-05-04 03. CVE-2024-28224: Ollama DNS rebinding vulnerabilityOllama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion). Ollama 2024-04-08