{"data":{"id":"407a6f79-dc32-46cf-ad92-e47106c6274d","title":"CVE-2024-28224: Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API…","summary":"CVE-2024-28224 affects Ollama before 0.1.29. A DNS rebinding vulnerability can inadvertently allow remote access to the full API, letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service through resource exhaustion. The weakness is classified as CWE-346 (Origin Validation Error).","solution":"Fixed in 0.1.29 or later, per the Ollama releases page cited in the references.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-28224","publishedAt":"2024-04-08T23:15:07.353Z","cveId":"CVE-2024-28224","cweIds":["CWE-346"],"cvssScore":"6.6","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/ollama/ollama@< 0.1.29 (fixed: 0.1.29)"],"affectedPackageNames":["github.com/ollama/ollama"],"affectedPackageRefs":["go:github.com/ollama/ollama"],"affectedVendors":[],"affectedVendorsRaw":["Ollama"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Ollama DNS rebinding allows remote access to the full API","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00354,"epssCheckedAt":"2026-11-04T06:10:14.105Z","kevDateAdded":null,"advisoryAliases":["GHSA-5jx5-hqx5-2vrj"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:19.673Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-03-10T23:21:05.000Z","daysToFix":-29,"fixCheckedAt":"2026-10-29T21:46:16.394Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/ollama/ollama","fixedVersion":"0.1.29","matchedVersion":"v0.1.29","fixReleasedAt":"2024-03-10T23:21:05.000Z","daysToFix":-29,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:46:16.243Z"}]}}