github-starred/ollama
2
0
Fork 0
mirror of https://github.com/ollama/ollama.git synced 2026-05-08 00:51:34 -05:00
Code Issues 14.5k Packages Projects Releases 120 Wiki Activity

[GH-ISSUE #14233] Released binaries have High severity CVEs due to Go version 1.24.1 #35027

New Issue
Open
opened 2026-04-22 19:08:38 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-22 19:08:38 -05:00
Owner
Copy Link

Originally created by @chelis on GitHub (Feb 13, 2026).
Original GitHub issue: https://github.com/ollama/ollama/issues/14233

What is the issue?

Scanning linux binary with govulncheck yields a big list of CVEs. In particular this one has been raised to level 10 - critical

Vulnerability #5: GO-2026-4337
    Unexpected session resumption in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-4337
  Standard library
    Found in: crypto/tls@go1.24.1
    Fixed in: crypto/tls@go1.24.13
    Vulnerable symbols found:
      #1: tls.Conn.Handshake
      #2: tls.Conn.Handshake
      #3: tls.Conn.Handshake
      #4: tls.Conn.HandshakeContext
      #5: tls.Conn.HandshakeContext
      Use '-show traces' to see the other 22 found symbols

Upgrading to 1.24.13 would fix the issue, however as 1.24 line is now out of support (1.26 has just been released). I would recommend either

  • upgrading to 1.25.7 (previous 1.25 versions are also affected)
  • Upgrade to Go 1.26.0 which came out a few days ago.

Based on this code in the Dockerfile, it would seem that updating the version in the go.mod would fix the issue.

Relevant log output

+ govulncheck -mode=binary bin/ollama
=== Symbol Results ===

Vulnerability #1: GO-2026-4403
    Improper access to parent directory of root in os
  More info: https://pkg.go.dev/vuln/GO-2026-4403
  Standard library
    Found in: os@go1.24.1
    Fixed in: os@go1.24.3
    Vulnerable symbols found:
      #1: os.checkPathEscapesInternal
      #2: os.doInRoot
      #3: os.splitPathInRoot

Vulnerability #2: GO-2026-4342
    Excessive CPU consumption when building archive index in archive/zip
  More info: https://pkg.go.dev/vuln/GO-2026-4342
  Standard library
    Found in: archive/zip@go1.24.1
    Fixed in: archive/zip@go1.24.12
    Vulnerable symbols found:
      #1: zip.Reader.Open

Vulnerability #3: GO-2026-4341
    Memory exhaustion in query parameter parsing in net/url
  More info: https://pkg.go.dev/vuln/GO-2026-4341
  Standard library
    Found in: net/url@go1.24.1
    Fixed in: net/url@go1.24.12
    Vulnerable symbols found:
      #1: url.ParseQuery
      #2: url.URL.Query

Vulnerability #4: GO-2026-4340
    Handshake messages may be processed at the incorrect encryption level in
    crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-4340
  Standard library
    Found in: crypto/tls@go1.24.1
    Fixed in: crypto/tls@go1.24.12
    Vulnerable symbols found:
      #1: tls.Conn.Handshake
      #2: tls.Conn.Handshake
      #3: tls.Conn.Handshake
      #4: tls.Conn.HandshakeContext
      #5: tls.Conn.HandshakeContext
      Use '-show traces' to see the other 23 found symbols

Vulnerability #5: GO-2026-4337
    Unexpected session resumption in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-4337
  Standard library
    Found in: crypto/tls@go1.24.1
    Fixed in: crypto/tls@go1.24.13
    Vulnerable symbols found:
      #1: tls.Conn.Handshake
      #2: tls.Conn.Handshake
      #3: tls.Conn.Handshake
      #4: tls.Conn.HandshakeContext
      #5: tls.Conn.HandshakeContext
      Use '-show traces' to see the other 22 found symbols

OS

Linux

GPU

Other

CPU

No response

Ollama version

0.15.6

Originally created by @chelis on GitHub (Feb 13, 2026). Original GitHub issue: https://github.com/ollama/ollama/issues/14233 ### What is the issue? Scanning linux binary with govulncheck yields a big list of CVEs. In particular this one has been raised to level [10 - critical](https://nvd.nist.gov/vuln/detail/cve-2025-68121) ``` Vulnerability #5: GO-2026-4337 Unexpected session resumption in crypto/tls More info: https://pkg.go.dev/vuln/GO-2026-4337 Standard library Found in: crypto/tls@go1.24.1 Fixed in: crypto/tls@go1.24.13 Vulnerable symbols found: #1: tls.Conn.Handshake #2: tls.Conn.Handshake #3: tls.Conn.Handshake #4: tls.Conn.HandshakeContext #5: tls.Conn.HandshakeContext Use '-show traces' to see the other 22 found symbols ``` Upgrading to 1.24.13 would fix the issue, however as 1.24 line is now out of support (1.26 has just been released). I would recommend either * upgrading to 1.25.7 (previous 1.25 versions are also affected) * Upgrade to Go 1.26.0 which came out a few days ago. Based on [this code](https://github.com/ollama/ollama/blob/main/Dockerfile#L153C5-L153C74) in the Dockerfile, it would seem that updating the version in the go.mod would fix the issue. ### Relevant log output ```shell + govulncheck -mode=binary bin/ollama === Symbol Results === Vulnerability #1: GO-2026-4403 Improper access to parent directory of root in os More info: https://pkg.go.dev/vuln/GO-2026-4403 Standard library Found in: os@go1.24.1 Fixed in: os@go1.24.3 Vulnerable symbols found: #1: os.checkPathEscapesInternal #2: os.doInRoot #3: os.splitPathInRoot Vulnerability #2: GO-2026-4342 Excessive CPU consumption when building archive index in archive/zip More info: https://pkg.go.dev/vuln/GO-2026-4342 Standard library Found in: archive/zip@go1.24.1 Fixed in: archive/zip@go1.24.12 Vulnerable symbols found: #1: zip.Reader.Open Vulnerability #3: GO-2026-4341 Memory exhaustion in query parameter parsing in net/url More info: https://pkg.go.dev/vuln/GO-2026-4341 Standard library Found in: net/url@go1.24.1 Fixed in: net/url@go1.24.12 Vulnerable symbols found: #1: url.ParseQuery #2: url.URL.Query Vulnerability #4: GO-2026-4340 Handshake messages may be processed at the incorrect encryption level in crypto/tls More info: https://pkg.go.dev/vuln/GO-2026-4340 Standard library Found in: crypto/tls@go1.24.1 Fixed in: crypto/tls@go1.24.12 Vulnerable symbols found: #1: tls.Conn.Handshake #2: tls.Conn.Handshake #3: tls.Conn.Handshake #4: tls.Conn.HandshakeContext #5: tls.Conn.HandshakeContext Use '-show traces' to see the other 23 found symbols Vulnerability #5: GO-2026-4337 Unexpected session resumption in crypto/tls More info: https://pkg.go.dev/vuln/GO-2026-4337 Standard library Found in: crypto/tls@go1.24.1 Fixed in: crypto/tls@go1.24.13 Vulnerable symbols found: #1: tls.Conn.Handshake #2: tls.Conn.Handshake #3: tls.Conn.Handshake #4: tls.Conn.HandshakeContext #5: tls.Conn.HandshakeContext Use '-show traces' to see the other 22 found symbols ``` ### OS Linux ### GPU Other ### CPU _No response_ ### Ollama version 0.15.6
GiteaMirror added the bug label 2026-04-22 19:08:38 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
amd
api
app
bug
build
cli
cloud
compatibility
context-length
create
docker
documentation
embeddings
feature request
feedback wanted
good first issue
gpt-oss
gpu
harmony
help wanted
image
install
intel
js
launch
linux
macos
memory
mlx
model
needs more info
networking
nvidia
ollama.com
performance
pull-request
Mirrored from GitHub Pull Request
 python
question
registry
rendering
thinking
tools
top
vulkan
windows
wsl
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/ollama#35027
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?