---
id: CVE-2024-28224
aliases:
  - GHSA-5jx5-hqx5-2vrj
  - GO-2024-2699
title: Ollama DNS rebinding vulnerability
summary: Ollama DNS rebinding vulnerability
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
vendor: ollama
product: github.com/ollama/ollama
ecosystem: go
affected:
  - github.com/ollama/ollama < 0.1.29
patched:
  - github.com/ollama/ollama 0.1.29
published: '2024-04-08'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:18.786132455Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-5jx5-hqx5-2vrj'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-28224'
  - url: 'https://github.com/ollama/ollama'
  - url: 'https://github.com/ollama/ollama/releases'
  - url: 'https://pkg.go.dev/vuln/GO-2024-2699'
  - url: >-
      https://research.nccgroup.com/2024/04/08/technical-advisory-ollama-dns-rebinding-attack-cve-2024-28224
  - url: 'https://www.nccgroup.trust/us/our-research/?research=Technical+advisories'
tags:
  - osv
  - go
epss: 0.00354
epssPercentile: 0.26369
ingestedAt: '2026-09-12T03:13:01.756Z'
---

## Overview

Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).

## Affected packages

- `github.com/ollama/ollama < 0.1.29`

## Remediation

Upgrade to a patched release:

- `github.com/ollama/ollama 0.1.29`