CVE-2026-108836mediumCWE-918

CVE-2026-108836: falha de média gravidade em Ollama

Ollama Pull API name.go IsValid server-side request forgery

Publicada em · Atualizada em

33Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 6.9epss 0.5%
probabilidade de exploração
0.5%top 61% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.34.2 is sufficient to fix this issue. The identifier of the patch is dfabde4539e42ba1e1eab50a3a50b88aea7958a0. It is suggested to upgrade the affected component.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
n/a · Ollama
PoCs públicas encontradas — 1
cve_referencegithub.com/aLtEr6/test/blob/main/test.pdfnão verificado
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://github.com/aLtEr6/test/blob/main/test.pdfhttps://github.com/aLtEr6/test.githttps://github.com/ollama/ollama/https://github.com/ollama/ollama/commit/dfabde4539e42ba1e1eab50a3a50b88aea7958a0https://github.com/ollama/ollama/pull/18512https://github.com/ollama/ollama/releases/tag/v0.34.2https://vuldb.com/cve/CVE-2026-108836https://vuldb.com/submit/972855https://vuldb.com/vuln/416610https://vuldb.com/vuln/416610/cti