VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/ollama/ollama: vulnerability history, versions and safety

github.com/ollama/ollama is a package in the Go ecosystem. Vulert records 31 vulnerabilities for it across 120 releases, from Apr 2024 to Jul 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
31 vulnerabilities recorded C1 H11 M3 L1 U15
i
20 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
6 in the last 12 months

Most recent disclosure 27 Jul 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/ollama/ollama vulnerabilities

Vulert verdict on github.com/ollama/ollama v0.40.8 i

Updated on 23 Oct 2026

Careful: v0.40.8 has 31 known vulnerabilities, and 20 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 50/100
  • Security Unfixed issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Active

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v0.40.8 — affected i
  • Vulnerabilities on record 31 over 2 years · 6 in the last year i
  • Latest disclosure 27 Jul 2026 i
  • Highest CVSS 9.3 i
  • With no published fix 20 i
  • Stars 183,491 i
  • Last release this month i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/ollama/ollama, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.40.9-rc2 22 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.9-rc1.0.20261022020018-efabf6bc4504 22 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.9-rc1 22 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.9-rc0 21 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.8 21 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.8-rc0 21 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.7 20 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.7-rc1 20 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.7-rc0.0.20261020015148-e61ba8b470b9 20 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.7-rc0.0.20261019122535-678722224b3d 19 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.7-rc0.0.20261018003152-36a6e994d2f6 18 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.7-rc0 17 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.7-0.20261017202216-e51196fe8c70 17 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.7-0.20261017014546-d1ed3fd13ac7 17 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.6 16 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.6-rc1.0.20261016230101-2476d5ead197 16 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.6-rc1 16 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.6-0.20261016010941-d9b86018cba1 16 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.6-rc0 16 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.5 15 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.5-rc2 15 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.5-rc1 15 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.5-rc0.0.20261015023506-8e4dad49f9f5 15 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.5-rc0.0.20261015011656-957c8cd5ce85 15 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.5-rc0.0.20261014235738-d10d1066eef4 14 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.5-rc0 14 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.5-0.20261014150914-f5be23f42d5a 14 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.5-0.20261014144107-cf410b09f026 14 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.5-0.20261014001711-8718c2bd2363 14 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.4-rc2.0.20261013221217-63b4f61ca926 13 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.4 13 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.4-rc2 13 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.4-rc1 13 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.4-rc0.0.20261013004350-a5276525531a 13 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.4-rc0.0.20261012215025-04730395aff8 12 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.4-rc0.0.20261012200713-8583859ea6d8 12 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.4-rc0.0.20261012180220-c9e601e59bdb 12 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.4-rc0 12 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.4-0.20261012062523-c1c536297f5b 12 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.3-0.20261009183155-2a20f2e2cd33 09 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.3 09 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.3-0.20261009173611-eab97e9f92b9 09 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.3-rc0 09 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.3-0.20261009150407-021cda52280d 09 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.3-0.20261008201809-c2b7368d4156 08 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.2 08 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.2-rc0 08 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.1-rc0.0.20261007224102-e3cddc3e897d 07 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.2-0.20261007224102-e3cddc3e897d 07 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.1 07 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.1-rc0 07 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.1-0.20261007203452-f9f4af6ce092 07 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.1-0.20261007175157-468e7e500842 07 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.1-0.20261007043934-d3c846f8b027 07 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.1-0.20261007013154-f864601538bd 07 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.0 06 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.0-rc6 06 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.0-rc5 06 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.0-rc4 06 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.35.2-0.20261005215440-ec8e5a4dcdea 05 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.0-rc3 04 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.0-rc2 04 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.0-rc1 04 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.35.2-0.20261002185227-42e911bc3d05 02 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.35.1 02 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.35.1-rc2 02 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.35.1-rc1 01 Oct 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.35.1-rc0 29 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.35.1-0.20260929012508-a8aaf9fcfad2 29 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.35.0 28 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.35.0-rc1 28 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.35.0-rc0 28 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.5-0.20260926142954-16b4376aeadb 26 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.40.0-rc0 25 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.5-0.20260924220328-7af393188def 24 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.4 23 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.4-rc1 23 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.4-rc0.0.20260923012811-c1737589973d 23 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.4-rc0 23 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.4-0.20260922202858-ac3439083dab 22 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.4-0.20260922182411-5a0ff3116d7d 22 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.4-0.20260922182411-a9d8953ab0ed 22 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.3 19 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.3-rc1 19 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.3-0.20260918211053-d0c8cdb795d4 18 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.3-rc0 18 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.3-0.20260917233942-4f6f73983036 17 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.2 17 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.2-rc3.0.20260917211018-35bdad61df45 17 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.2-rc3 17 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.2-rc2 17 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.2-rc1.0.20260916232058-28a9f8c955b7 16 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.2-rc1 16 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.1-0.20260916003631-e8540bbceffe 16 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.1-0.20260915222023-89746047fcc1 15 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.1-0.20260915203038-d4eed110ce6e 15 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.2-0.20260915201331-a43fad18b088 15 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.2-rc0 15 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.1-0.20260915174732-510bc3d6f0d8 15 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.1 15 Sep 2026 C1 H11 M3 L1 U15 MIT No Details →
v0.34.1-rc2.0.20260915063230-38fdb5dd58c7 15 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.34.1-rc2 15 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.34.1-rc1 14 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.34.1-rc0 14 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.34.1-0.20260911202508-53fed2611281 11 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.34.0-rc5.0.20260909220242-159b1c3331a1 09 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.34.1-0.20260909220242-159b1c3331a1 09 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.34.0 09 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.34.0-rc5 09 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.34.0-rc4 09 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.34.0-rc3 09 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.34.0-rc2 08 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.34.0-rc1.0.20260908175523-3b5ab1fcfcb0 08 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.34.0-rc1 05 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.34.0-rc0.0.20260904213805-d3efc63263e3 04 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.34.0-rc0 04 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.33.4-0.20260903224934-b68365a0a4e2 03 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.33.3 02 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.33.3-rc1.0.20260902220728-b79067b0db74 02 Sep 2026 C1 H11 M3 L1 U15 — No Details →
v0.33.3-rc2 02 Sep 2026 C1 H11 M3 L1 U15 — No Details →

The newest 120 of 1,259 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2024 7
  • 2025 19
  • 2026 5

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 6 of the 31 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/ollama/ollama

The 5 most severe of 31 vulnerabilities recorded for this package

Search all 31 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2025-63389: Ollama Platform Critical Authentication Bypass Vulnerability 9.3 critical No fix published 18 Dec 2025
CVE-2026-7482: Ollama Heap Out-of-Bounds Read Vulnerability in GGUF Model Loader 9.1 high 0.17.1 04 May 2026
CVE-2024-28224: Ollama DNS rebinding vulnerability in github.com/ollama/ollama 8.8 high 0.1.29 08 Apr 2024
CVE-2024-39720: Ollama Out-of-bounds Read Vulnerability 8.2 high 0.1.46 31 Oct 2024
Denial of Service Vulnerability in Ollama Package via GZIP Bomb 7.5 high No fix published 20 Mar 2025

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/ollama/ollama

Is github.com/ollama/ollama safe to use?

Vulert records 31 vulnerabilities for github.com/ollama/ollama in Go: 1 critical, 11 high, 3 medium and 1 low, plus 15 not yet rated. 20 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/ollama/ollama's Vulert package health score?

Vulert scores github.com/ollama/ollama 50/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/ollama/ollama affected?

Yes. v0.40.8, the version you would install today, has 31 known vulnerabilities, and 20 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

How many vulnerabilities does github.com/ollama/ollama have?

31 vulnerabilities are recorded for github.com/ollama/ollama in the Go ecosystem: 1 critical, 11 high, 3 medium and 1 low, plus 15 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/ollama/ollama vulnerabilities disclosed?

6 vulnerabilities were recorded for github.com/ollama/ollama in the last 12 months, and the oldest entry in this database dates to 08 Apr 2024. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/ollama/ollama are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/ollama/ollama for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/ollama/ollama version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.