Action not permitted
Modal body text goes here.
Modal Title
Modal Body
Vulnerability from cleanstart
Published
2026-08-13 12:10
Modified
2026-08-14 05:56
Summary
Security fixes in ollama-fips 0.30.11-r1
Details
Package ollama-fips version 0.30.11-r1 fixes 4 vulnerabilities: CVE-2026-33813, CVE-2026-46601, CVE-2026-46602, CVE-2026-46604
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"package": {
"ecosystem": "Alpine",
"name": "ollama-fips"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.30.11-r1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.30.11-r1"
]
}
],
"credits": [],
"database_specific": {},
"details": "Package ollama-fips version 0.30.11-r1 fixes 4 vulnerabilities: CVE-2026-33813, CVE-2026-46601, CVE-2026-46602, CVE-2026-46604",
"id": "CLEANSTART-2026-SX37147",
"modified": "2026-08-14T05:56:24Z",
"published": "2026-08-13T12:10:09Z",
"references": [
{
"type": "WEB",
"url": "https://ollama.com"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes in ollama-fips 0.30.11-r1",
"upstream": [
"CVE-2026-33813",
"CVE-2026-46601",
"CVE-2026-46602",
"CVE-2026-46604"
]
}
CVE-2026-33813 (GCVE-0-2026-33813)
Vulnerability from cvelistv5 – Published: 2026-04-21 19:21 – Updated: 2026-06-25 19:47
VLAI
EPSS
VEX
Title
Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image
Summary
Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-22 15:23 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/image | golang.org/x/image/webp |
Affected:
0 , < 0.42.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-33813",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-22T15:23:43.643284Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-22T15:34:46.427Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/image/webp",
"product": "golang.org/x/image/webp",
"programRoutines": [
{
"name": "decode"
},
{
"name": "Decode"
},
{
"name": "DecodeConfig"
}
],
"vendor": "golang.org/x/image",
"versions": [
{
"lessThan": "0.42.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Tristan Madani"
}
],
"descriptions": [
{
"lang": "en",
"value": "Parsing a WEBP image with an invalid, large size panics on 32-bit platforms."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T19:47:15.561Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/759860"
},
{
"url": "https://go.dev/cl/780860"
},
{
"url": "https://go.dev/issue/78407"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-4961"
}
],
"title": "Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-33813",
"datePublished": "2026-04-21T19:21:27.644Z",
"dateReserved": "2026-03-23T20:35:32.814Z",
"dateUpdated": "2026-06-25T19:47:15.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46601 (GCVE-0-2026-46601)
Vulnerability from cvelistv5 – Published: 2026-06-25 19:47 – Updated: 2026-06-26 16:09
VLAI
EPSS
VEX
Title
Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image
Summary
The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-26 16:08 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/image | golang.org/x/image/webp |
Affected:
0 , < 0.43.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-46601",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-26T16:08:56.631719Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T16:09:18.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/image/webp",
"product": "golang.org/x/image/webp",
"programRoutines": [
{
"name": "decode"
},
{
"name": "Decode"
},
{
"name": "DecodeConfig"
}
],
"vendor": "golang.org/x/image",
"versions": [
{
"lessThan": "0.43.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/image/webp",
"product": "golang.org/x/image/webp",
"vendor": "golang.org/x/image",
"versions": [
{
"lessThan": "0.43.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Lucas Futures (GitHub: gn00295120)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-125: Out-of-bounds Read",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T19:47:21.500Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/787681"
},
{
"url": "https://go.dev/issue/79869"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-5061"
}
],
"title": "Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-46601",
"datePublished": "2026-06-25T19:47:21.500Z",
"dateReserved": "2026-05-15T17:35:00.814Z",
"dateUpdated": "2026-06-26T16:09:18.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46602 (GCVE-0-2026-46602)
Vulnerability from cvelistv5 – Published: 2026-06-25 19:47 – Updated: 2026-06-26 16:07
VLAI
EPSS
VEX
Title
Lack of limit on tile sizes in x/image/tiff in golang.org/x/image
Summary
The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-26 16:05 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/image | golang.org/x/image/tiff |
Affected:
0 , < 0.43.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-46602",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-26T16:05:58.046352Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T16:07:00.792Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/image/tiff",
"product": "golang.org/x/image/tiff",
"programRoutines": [
{
"name": "Decode"
}
],
"vendor": "golang.org/x/image",
"versions": [
{
"lessThan": "0.43.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Prasanna Dabi (GitHub: prasanna8585)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T19:47:21.690Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/788422"
},
{
"url": "https://go.dev/issue/79905"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-5062"
}
],
"title": "Lack of limit on tile sizes in x/image/tiff in golang.org/x/image"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-46602",
"datePublished": "2026-06-25T19:47:21.690Z",
"dateReserved": "2026-05-15T17:35:00.814Z",
"dateUpdated": "2026-06-26T16:07:00.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46604 (GCVE-0-2026-46604)
Vulnerability from cvelistv5 – Published: 2026-06-26 20:22 – Updated: 2026-06-29 13:20
VLAI
EPSS
VEX
Title
Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image
Summary
The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-29 13:20 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| golang.org/x/image | golang.org/x/image/tiff |
Affected:
0 , < 0.43.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-46604",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-29T13:20:19.539584Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-29T13:20:23.731Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "golang.org/x/image/tiff",
"product": "golang.org/x/image/tiff",
"programRoutines": [
{
"name": "Decode"
}
],
"vendor": "golang.org/x/image",
"versions": [
{
"lessThan": "0.43.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "sorte"
}
],
"descriptions": [
{
"lang": "en",
"value": "The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-125: Out-of-bounds Read",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T20:22:46.377Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/788421"
},
{
"url": "https://go.dev/issue/80122"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-5066"
}
],
"title": "Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-46604",
"datePublished": "2026-06-26T20:22:46.377Z",
"dateReserved": "2026-05-15T17:35:00.814Z",
"dateUpdated": "2026-06-29T13:20:23.731Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…