CVE-2026-108836

Publié : 12 octobre 2026

Modifié : 12 octobre 2026

Score CVSS

7.3

HIGH

Description détaillée

A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.34.2 is sufficient to fix this issue. The identifier of the patch is dfabde4539e42ba1e1eab50a3a50b88aea7958a0. It is suggested to upgrade the affected component.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Références et Patchs

https://github.com/aLtEr6/test.git https://github.com/aLtEr6/test/blob/main/test.pdf https://github.com/ollama/ollama/https://github.com/ollama/ollama/commit/dfabde4539e42ba1e1eab50a3a50b88aea7958a0 https://github.com/ollama/ollama/pull/18512 https://github.com/ollama/ollama/releases/tag/v0.34.2 https://vuldb.com/cve/CVE-2026-108836 https://vuldb.com/submit/972855 https://vuldb.com/vuln/416610 https://vuldb.com/vuln/416610/cti

Dernières Vulnérabilités

CVE-2026-68764

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS

CVE-2026-18390

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows OS Command Injection. This issue affects UYAP Document Editor: before 5.4.20.

VOIR DÉTAILS

CVE-2026-12613

Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows Object Injection. This issue affects UYAP Document Editor: before 5.4.20.

VOIR DÉTAILS