ACVE-2024-0001

The configuration

Configuration label

ollama <0.1.34

Affected entries

• AgentHarness: ollama — SEMVER (introduced 0; fixed 0.1.34)

Matcher

• all
  • harness.id eq "ollama"
  • harness.version semverRange "<0.1.34"

Why it is exploitable

What the vulnerability is

Ollama before 0.1.34 can mishandle a model digest while pulling model data. The path traversal can write files outside the intended model location and, in the documented attack chain, reach code execution. The affected component is the Ollama service, not the model itself.

Which configuration is exposed

The exposed harness is Ollama with harness.id equal to ollama and a version below 0.1.34. The matcher intentionally encodes only that version condition. Exposure is more serious when OLLAMA_HOST binds the API off loopback, because a remote client can reach the service; a loopback-only binding limits that network path. The matcher does not read OLLAMA_HOST, so ACVE cannot distinguish those deployment choices and reports the vulnerable version broadly.

How ACVE detects it

ACVE reads harness.id and harness.version from the lockfile and evaluates <0.1.34. It does not read the daemon's bind address, registry trust, model digest, container privilege, or whether a pull has occurred. A match therefore means that the vulnerable Ollama component is present; it is not proof that a reachable attacker has supplied a malicious model manifest.

Fix

1. Upgrade the Ollama harness to 0.1.34 or later.
2. Set OLLAMA_HOST to a loopback address unless remote access is required, and protect any intentionally remote endpoint with an appropriate network boundary.

The bind-address change reduces reachability during remediation, but only the upgrade removes the vulnerable path-handling implementation.

The bind-address change reduces reachability during remediation, but only the upgrade removes the vulnerable path-handling implementation.

References

See references for primary sources.

Underlying CVEs / aliases

• CVE-2024-37032

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Upgrade Ollama and bind its API to loopback unless remote access is required.

Validation

Grounding

• OSV: found; aliases: CVE-2024-37032, GHSA-8hqg-whrw-pv92, GO-2024-2901; checked-at 2026-09-20T02:43:19Z
• NVD: found; checked-at 2026-09-20T02:43:19Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:19Z

References

ADVISORY

• https://nvd.nist.gov/vuln/detail/CVE-2024-37032

REPORT

• https://example.com/research/acve

FIX

• https://github.com/pickbitsai/acve/issues?q=CVE-2024-37032