CVE-2025-0315: 
NixOS vulnerability analysis and mitigation

A vulnerability (CVE-2025-0315) was discovered in ollama/ollama versions 0.3.14 and earlier. The vulnerability allows a malicious user to create a customized GGUF model file, upload it to the Ollama server, and create it, which can cause the server to allocate unlimited memory, leading to a Denial of Service (DoS) attack. The vulnerability was disclosed on March 20, 2025 (NVD).

The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). It has received a CVSS v3.0 base score of 7.5 (HIGH) with the vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network accessibility, low attack complexity, no privileges required, and high impact on availability (NVD).

When exploited, this vulnerability can cause the Ollama server to allocate unlimited memory resources, resulting in a Denial of Service condition that could make the service unavailable to legitimate users (NVD).

The vulnerability requires a malicious user to create and upload a specially crafted GGUF model file to the Ollama server. The attack vector is network-accessible and requires no special privileges or user interaction to exploit (NVD).

Users should upgrade to a version newer than ollama/ollama 0.3.14 once available. No specific workarounds have been publicly documented at the time of disclosure (NVD).