CVE-2025-1975: 
NixOS vulnerability analysis and mitigation

A vulnerability (CVE-2025-1975) was discovered in the Ollama server version 0.5.11 that allows a malicious user to cause a Denial of Service (DoS) attack. The vulnerability was disclosed on May 16, 2025, and affects the server's model downloading functionality via the /api/pull endpoint (NVD, Wiz).

The vulnerability stems from improper validation of array index access when downloading a model via the /api/pull endpoint. The issue is classified as CWE-129 (Improper Validation of Array Index) and has been assigned a CVSS v3.0 base score of 7.5 (HIGH) with the vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability allows attackers to cause a server crash through customized manifest content and service spoofing, resulting in a Denial of Service condition (NVD, Wiz).

The vulnerability has been reported through the Huntr platform, with an Exploitation Probability (EPSS) score of 0.1 and an Exploitation Probability Percentile of 17.8. Currently, there are no known public exploits for this vulnerability (Wiz).

The vulnerability has been reported through the Huntr platform, suggesting that a fix may be available or in development. Users should monitor for updates from the Ollama project and apply patches when available (Huntr).