---
title: "CVE-2024-37032: Ollama vulnerability"
url: https://erroneo.us/security/cve/CVE-2024-37032/
description: "CVE-2024-37032 (Ollama): Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus…"
type: vulnerability-record
section: "Security Digest"
date_published: 2024-05-31
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2024-37032"
kev: false
cvss: 8.8
epss: 0.89633
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2024-37032: Ollama vulnerability

**Signal:** High exploit likelihood. EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 89.6% , percentile 99.8: FIRST’s model estimates a 89.6% chance of exploitation activity in the next 30 days, higher than 99.8% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Editorial verdict: Check exposure. Probllama: Ollama Path Traversal to RCE (CVE-2024-37032) — The bug was fixed in May 2024, so anything current is patched; the lasting risk is Ollama servers left reachable from the internet with no authentication, which is still very common.

## What it is

Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.

## Affected products (CVE record)

- n/a n/a: see advisory

## Severity

- CISA-ADP CVSS 3.1: 8.8 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact partial .
- FIRST EPSS (model of 2026-10-21): 89.63% probability of exploitation activity in the next 30 days; percentile 99.8.

## Sources

- [CVE.org record CVE-2024-37032](https://www.cve.org/CVERecord?id=CVE-2024-37032)
- [NVD entry CVE-2024-37032](https://nvd.nist.gov/vuln/detail/CVE-2024-37032)
- [github.com](https://github.com/ollama/ollama/pull/4175)
- [github.com](https://github.com/ollama/ollama/compare/v0.1.33...v0.1.34)
- [github.com](https://github.com/ollama/ollama/blob/adeb40eaf29039b8964425f69a9315f9f1694ba8/server/modelpath_test.go#L41-L58)
- [vicarius.io](https://www.vicarius.io/vsociety/posts/probllama-in-ollama-a-tale-of-a-yet-another-rce-vulnerability-cve-2024-37032)

---
Source page: https://erroneo.us/security/cve/CVE-2024-37032/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt