# CVE-2024-12886

## Summary

- **CVE ID:** CVE-2024-12886
- **Severity:** HIGH
- **CVSS Score:** 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- **CWE:** CWE-409
- **Published:** Mar 20, 2025
- **Last Modified:** Mar 13, 2026

## Description

An Out-Of-Memory (OOM) vulnerability exists in the `ollama` server version 0.3.14. This vulnerability can be triggered when a malicious API server responds with a gzip bomb HTTP response, leading to the `ollama` server crashing. The vulnerability is present in the `makeRequestWithRetry` and `getAuthorizationToken` functions, which use `io.ReadAll` to read the response body. This can result in excessive memory usage and a Denial of Service (DoS) condition.

## Affected Products

- ollama — ollama/ollama (unspecified)

## References

- [CNA](https://huntr.com/bounties/f115fe52-58af-4844-ad29-b1c25f7245df)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.71%
- **EPSS Percentile:** 51.3

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._