CVE-2025-1975

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by customizing the manifest content and spoofing a service. This is due to improper validation of array index access when downloading a model via the /api/pull endpoint, which can lead to a server crash.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-129

Affected software

Vendor	Product	Versions
ollama	ollama/ollama	>= unspecified, <= latest

References

https://huntr.com/bounties/921ba5d4-f1d0-4c66-9764-4f72dffe7acdExploit, Third Party Advisory

Timeline

Published: May 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-19766.7Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute CVE-2025-19777.7The NPort 6100-G2/6200-G2 Series is affected by an execution with unnecessary privileges vulnerability (CVE-2025-1977) that allows an authen CVE-2025-19789.8Remote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console in Hitachi Virtual Storage Platform G130, G150,CVE-2025-19796.4Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is bei CVE-2025-19809.4The Ready_ application's Profile section allows users to upload files of any type and extension without restriction. If the server is miscon CVE-2025-19819.4Improper neutralization of input provided by a low-privileged user into a file search functionality in Ready_'s Invoices module allows for S CVE-2025-19827.1Local File Inclusion vulnerability in Ready's attachment upload panel allows low privileged user to provide link to a local file using the f CVE-2025-19835.1A cross-site scripting (XSS) vulnerability in Ready_'s File Explorer upload functionality allows injection of arbitrary JavaScript code in f CVE-2025-19845.2Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to CVE-2025-19856.1Due to improper neutralization of input during web page generation (XSS) an unauthenticated remote attacker can inject HTML code into the We CVE-2025-19864.1The Gutentor WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to CVE-2025-19876.1A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and book