CVE-2024-37032

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: May 31, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-370345.9An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with the CVE-2024-370369.8CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass when sending a malformed POST request and pa CVE-2024-370378.1CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability exists that could allow an authenticate CVE-2024-370388.8CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface CVE-2024-370397.5CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the device when an attacker sends a specially cra CVE-2024-37049.8SQL Injection Vulnerability has been found on OpenGnsys product affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to CVE-2024-370408.1CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability exists that could allow a user with access to CVE-2024-370417.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2024-370424.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability CVE-2024-370434.9A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could all CVE-2024-370447.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2024-370454.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability