MinatoWu opened a new issue, #848:
URL: https://github.com/apache/dubbo-go-samples/issues/848
**Dependency vulnerabilities detected with govulncheck tool**
=== Symbol Results ===
Vulnerability #1: GO-2025-3695
Ollama Server Vulnerable to Denial of Service (DoS) Attack in
github.com/ollama/ollama
More info: https://pkg.go.dev/vuln/GO-2025-3695
Module: github.com/ollama/ollama
Found in: github.com/ollama/[email protected]
Fixed in: N/A
Example traces found:
#1: book-flight-ai-agent/go-server/model/ollama/ollama.go:180:20:
ollama.LLMOllama.Invoke calls api.Client.Chat
#2: book-flight-ai-agent/go-server/model/ollama/ollama.go:123:24:
ollama.LLMOllama.Call calls api.Client.Generate
#3: book-flight-ai-agent/go-server/model/ollama/ollama.go:137:25:
ollama.LLMOllama.Invoke calls api.NewClient
#4: llm/go-client/frontend/handlers/chat.go:226:57:
handlers.ChatHandler.SwitchContext calls api.StatusError.Error
#5: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init
#6: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls envconfig.init
#7: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls format.init
#8: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls version.init
Vulnerability #2: GO-2025-3689
Ollama Divide by Zero Vulnerability in github.com/ollama/ollama
More info: https://pkg.go.dev/vuln/GO-2025-3689
Module: github.com/ollama/ollama
Found in: github.com/ollama/[email protected]
Fixed in: N/A
Example traces found:
#1: book-flight-ai-agent/go-server/model/ollama/ollama.go:180:20:
ollama.LLMOllama.Invoke calls api.Client.Chat
#2: book-flight-ai-agent/go-server/model/ollama/ollama.go:123:24:
ollama.LLMOllama.Call calls api.Client.Generate
#3: book-flight-ai-agent/go-server/model/ollama/ollama.go:137:25:
ollama.LLMOllama.Invoke calls api.NewClient
#4: llm/go-client/frontend/handlers/chat.go:226:57:
handlers.ChatHandler.SwitchContext calls api.StatusError.Error
#5: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init
#6: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls envconfig.init
#7: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls format.init
#8: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls version.init
Vulnerability #3: GO-2025-3595
Incorrect Neutralization of Input During Web Page Generation in x/net in
golang.org/x/net
More info: https://pkg.go.dev/vuln/GO-2025-3595
Module: golang.org/x/net
Found in: golang.org/x/[email protected]
Fixed in: golang.org/x/[email protected]
Example traces found:
#1: compatibility/generic/default/go-client/cmd/client.go:259:18:
cmd.newRefConf calls config.ReferenceConfig.Init, which eventually calls
html.Tokenizer.Next
Vulnerability #4: GO-2025-3582
Ollama Denial of Service (DoS) via Null Pointer Dereference in
github.com/ollama/ollama
More info: https://pkg.go.dev/vuln/GO-2025-3582
Module: github.com/ollama/ollama
Found in: github.com/ollama/[email protected]
Fixed in: N/A
Example traces found:
#1: book-flight-ai-agent/go-server/model/ollama/ollama.go:180:20:
ollama.LLMOllama.Invoke calls api.Client.Chat
#2: book-flight-ai-agent/go-server/model/ollama/ollama.go:123:24:
ollama.LLMOllama.Call calls api.Client.Generate
#3: book-flight-ai-agent/go-server/model/ollama/ollama.go:137:25:
ollama.LLMOllama.Invoke calls api.NewClient
#4: llm/go-client/frontend/handlers/chat.go:226:57:
handlers.ChatHandler.SwitchContext calls api.StatusError.Error
#5: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init
#6: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls envconfig.init
#7: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls format.init
#8: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls version.init
Vulnerability #5: GO-2025-3563
Request smuggling due to acceptance of invalid chunked data in net/http
More info: https://pkg.go.dev/vuln/GO-2025-3563
Standard library
Found in: net/http/[email protected]
Fixed in: net/http/[email protected]
Example traces found:
#1: llm/go-client/cmd/client.go:183:15: cmd.main calls
bufio.Scanner.Scan, which eventually calls internal.chunkedReader.Read
Vulnerability #6: GO-2025-3559
Ollama Divide By Zero vulnerability in github.com/ollama/ollama
More info: https://pkg.go.dev/vuln/GO-2025-3559
Module: github.com/ollama/ollama
Found in: github.com/ollama/[email protected]
Fixed in: N/A
Example traces found:
#1: book-flight-ai-agent/go-server/model/ollama/ollama.go:180:20:
ollama.LLMOllama.Invoke calls api.Client.Chat
#2: book-flight-ai-agent/go-server/model/ollama/ollama.go:123:24:
ollama.LLMOllama.Call calls api.Client.Generate
#3: book-flight-ai-agent/go-server/model/ollama/ollama.go:137:25:
ollama.LLMOllama.Invoke calls api.NewClient
#4: llm/go-client/frontend/handlers/chat.go:226:57:
handlers.ChatHandler.SwitchContext calls api.StatusError.Error
#5: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init
#6: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls envconfig.init
#7: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls format.init
#8: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls version.init
Vulnerability #7: GO-2025-3558
Ollama Allows Out-of-Bounds Read in github.com/ollama/ollama
More info: https://pkg.go.dev/vuln/GO-2025-3558
Module: github.com/ollama/ollama
Found in: github.com/ollama/[email protected]
Fixed in: N/A
Example traces found:
#1: book-flight-ai-agent/go-server/model/ollama/ollama.go:180:20:
ollama.LLMOllama.Invoke calls api.Client.Chat
#2: book-flight-ai-agent/go-server/model/ollama/ollama.go:123:24:
ollama.LLMOllama.Call calls api.Client.Generate
#3: book-flight-ai-agent/go-server/model/ollama/ollama.go:137:25:
ollama.LLMOllama.Invoke calls api.NewClient
#4: llm/go-client/frontend/handlers/chat.go:226:57:
handlers.ChatHandler.SwitchContext calls api.StatusError.Error
#5: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init
#6: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls envconfig.init
#7: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls format.init
#8: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls version.init
Vulnerability #8: GO-2025-3557
Ollama Allocation of Resources Without Limits or Throttling
vulnerability in
github.com/ollama/ollama
More info: https://pkg.go.dev/vuln/GO-2025-3557
Module: github.com/ollama/ollama
Found in: github.com/ollama/[email protected]
Fixed in: N/A
Example traces found:
#1: book-flight-ai-agent/go-server/model/ollama/ollama.go:180:20:
ollama.LLMOllama.Invoke calls api.Client.Chat
#2: book-flight-ai-agent/go-server/model/ollama/ollama.go:123:24:
ollama.LLMOllama.Call calls api.Client.Generate
#3: book-flight-ai-agent/go-server/model/ollama/ollama.go:137:25:
ollama.LLMOllama.Invoke calls api.NewClient
#4: llm/go-client/frontend/handlers/chat.go:226:57:
handlers.ChatHandler.SwitchContext calls api.StatusError.Error
#5: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init
#6: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls envconfig.init
#7: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls format.init
#8: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls version.init
Vulnerability #9: GO-2025-3548
Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIP in
github.com/ollama/ollama
More info: https://pkg.go.dev/vuln/GO-2025-3548
Module: github.com/ollama/ollama
Found in: github.com/ollama/[email protected]
Fixed in: N/A
Example traces found:
#1: book-flight-ai-agent/go-server/model/ollama/ollama.go:180:20:
ollama.LLMOllama.Invoke calls api.Client.Chat
#2: book-flight-ai-agent/go-server/model/ollama/ollama.go:123:24:
ollama.LLMOllama.Call calls api.Client.Generate
#3: book-flight-ai-agent/go-server/model/ollama/ollama.go:137:25:
ollama.LLMOllama.Invoke calls api.NewClient
#4: llm/go-client/frontend/handlers/chat.go:226:57:
handlers.ChatHandler.SwitchContext calls api.StatusError.Error
#5: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init
#6: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls envconfig.init
#7: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls format.init
#8: book-flight-ai-agent/go-server/model/ollama/ollama.go:28:2:
ollama.init calls api.init, which calls version.init
Vulnerability #10: GO-2024-2978
Private tokens could appear in logs if context containing gRPC metadata
is
logged in google.golang.org/grpc
More info: https://pkg.go.dev/vuln/GO-2024-2978
Module: google.golang.org/grpc
Found in: google.golang.org/[email protected]
Fixed in: google.golang.org/[email protected]
Example traces found:
#1: book-flight-ai-agent/go-server/prompts/prompt.go:35:63:
prompts.CreatePrompt calls fmt.Sprintln, which eventually calls
metadata.MD.String
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
