← Database

CVE-2024-39721

HIGH CVSS: 7.5 Published: 2024-10-31 Modified: 2026-06-17

Description

An issue was discovered in Ollama before 0.1.34. The CreateModelHandler function uses os.Open to read a file until completion. The req.Path parameter is user-controlled and can be set to /dev/random, which is blocking, causing the goroutine to run infinitely (even after the HTTP request is aborted by the client).

Affected Platforms

Ollama Ollama

Weakness Type

CWE-404

References