7.5

CVE-2025-1975: ollama Improper Validation of Array Index

CVSS: 7.5v3.0HighAnalyzed
AliasesPYSEC-2025-145GHSA-wrh5-cmwx-q2qrGO-2025-3695
Published 16-05-2025Last modified 16-05-2025
Open JSON

Vulnerability summary

CVE-2025-1975 is a high (CVSS 7.5) Improper Validation of Array Index vulnerability in ollama. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
40/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.0 (CVE.org)
EPSS score
0.52%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 1 · Related 2
OPENSUSE-SU-2025:15159-1CGA-63JP-HPJV-73MH

Timeline

  1. 16-05-2025
    PublishedVulnerability first disclosed.
  2. 16-05-2025
    Last modifiedVulnerability information updated.

Description

A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by customizing the manifest content and spoofing a service. This is due to improper validation of array index access when downloading a model via the /api/pull endpoint, which can lead to a server crash.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

0.52%

Chance of exploitation in the next 30 days

Percentile

43%

Versus all other CVEs

30-day change

+0.02 pp

From 0.50% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.52%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (huntr.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Chainguard3 products
  • k8sgpt< 0.4.28-r0
  • mods< 1.8.1-r14
  • ollama-fipsAll versions (No fix recorded)
Ollama2 products
Wolfi2 products
  • k8sgpt< 0.4.28-r0
  • mods< 1.8.1-r14
Github.com/ollama1 product
  • ollama≤ 0.5.11 | All versions (No fix recorded)
PyPI1 product
  • ollama≤ 0.5.11

5 vendors · 9 products

References

7 links