Skip to content
Heist/ feed
High

Ollama Pull API name.go IsValid server-side request forgery

Type: advisorySource: Official CVE List1 source record

A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.34.2 is sufficient to fix this issue. The identifier of the patch is dfabde4539e42ba1e1eab50a3a50b88aea7958a0. It is suggested to upgrade the affected component.

Announced Source revision 1
Original source ↗

CVE-2026-108836

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-108836

Ollama

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "cpes": [
      "cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*"
    ],
    "vendor": "n/a",
    "modules": [
      "Pull API"
    ],
    "product": "Ollama",
    "versions": [
      {
        "status": "affected",
        "version": "0.34.0"
      },
      {
        "status": "affected",
        "version": "0.34.1"
      },
      {
        "status": "unaffected",
        "version": "0.34.2"
      }
    ]
  }
]
Related CVEs
CVE-2026-108836

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#20667 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement