{"action":"Upgrade github.com/ollama/ollama to 0.1.34 or later.","affected":[{"fixed":"0.1.34","introduced":"0"}],"component":"github.com/ollama/ollama","cve_ids":["CVE-2024-37032"],"ecosystem":"Go","epss":0.89633,"exploited":false,"fixed_versions":["0.1.34"],"ghsa_id":"GHSA-8hqg-whrw-pv92","id":"tcs_01M5KF3VK99NZCVDPA2GEZPQK7","modified_at":"2026-09-10T03:50:13.660547949Z","published_at":"2024-05-31T06:30:27Z","references":["https://osv.dev/vulnerability/GHSA-8hqg-whrw-pv92","https://nvd.nist.gov/vuln/detail/CVE-2024-37032","https://github.com/ollama/ollama/pull/4175","https://github.com/ollama/ollama/commit/2a21363bb756a7341d3d577f098583865bd7603f","https://github.com/advisories/GHSA-8hqg-whrw-pv92","https://github.com/ollama/ollama","https://github.com/ollama/ollama/blob/adeb40eaf29039b8964425f69a9315f9f1694ba8/server/modelpath_test.go#L41-L58","https://github.com/ollama/ollama/compare/v0.1.33...v0.1.34","https://pkg.go.dev/vuln/GO-2024-2901","https://www.vicarius.io/vsociety/posts/probllama-in-ollama-a-tale-of-a-yet-another-rce-vulnerability-cve-2024-37032"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-8hqg-whrw-pv92","url":"https://osv.dev/vulnerability/GHSA-8hqg-whrw-pv92"}],"summary":"Ollama does not validate the format of the digest (sha256 with 64 hex digits)"}