data/reports: set fixed version for GO-2025-3824

[nghiadaulau]

GO-2025-3824 (CVE-2025-51471, Ollama cross-domain token exposure) has no
fixed version, only introduced: 0, and the report notes "No patched
version specified". As a result govulncheck and pkg.go.dev report the
vulnerability against every version of github.com/ollama/ollama,
including current releases such as
v0.32.4. The
upstream source advisory GHSA-x9hg-5q6g-q3jr carries only
last_affected: 0.9.6, which is why no fix was recorded.

The vulnerability has been fixed upstream.

Evidence

The advisory describes a missing same-host check in
server.auth.getAuthorizationToken: the realm URL from a
WWW-Authenticate header is followed without verifying it belongs to the
host of the original request.

That check was added in
ollama/ollama#13738
("server: reject unexpected auth hosts"), merged 2026-01-16 as commit
7601f0e:

 func getAuthorizationToken(ctx context.Context, challenge registryChallenge, originalHost string) (string, error) {
 	redirectURL, err := challenge.URL()
 	if err != nil {
 		return "", err
 	}

+	// Validate that the realm host matches the original request host to prevent sending tokens cross-origin.
+	if redirectURL.Host != originalHost {
+		return "", fmt.Errorf("realm host %q does not match original host %q", redirectURL.Host, originalHost)
+	}

server/auth.go is byte-identical between v0.9.6 and v0.14.2, so no
earlier release carried the check, and v0.14.3 is the first release
tag containing the fix commit:

$ git ls-tree v0.9.6  server/ | grep auth.go
100644 blob dcef5bf9cc249e624758551a384646d28e7c2c57	server/auth.go
$ git ls-tree v0.14.2 server/ | grep auth.go
100644 blob dcef5bf9cc249e624758551a384646d28e7c2c57	server/auth.go

$ git tag --contains 7601f0e93e53858f09136a7e4ccf674a9b4580bd | grep -v rc | sort -V | head -1
v0.14.3

The affected range is therefore [0, 0.14.3), and vulnerable_at is
updated to 0.14.2 accordingly.

Also in this change

The existing fix: reference pointed at
ollama/ollama#10750, which
is the reporter's proposed patch and was closed unmerged. It is demoted
to a web: reference and #13738 is recorded as the fix.

data/osv/GO-2025-3824.json was regenerated with
go run ./cmd/vulnreport fix data/reports/GO-2025-3824.yaml; vulnreport lint passes.

I have also opened
github/advisory-database#8826
to correct the source GHSA record.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[nghiadaulau]

I signed it!

[dragoncoil2609]

I signed it! wow

[pho-veteran]

I think this looks great. I really appreciate how thoroughly the change was handled, especially the effort to trace the actual fix and distinguish it from the earlier unmerged reference.

From what I can verify, the vulnerability metadata now correctly identifies v0.14.3 as the first fixed version and v0.14.2 as the latest affected version. The references also appear to accurately reflect what happened upstream, and the regenerated OSV data is consistent with those updates.

This should help prevent fixed Ollama versions from being incorrectly reported as vulnerable by tools consuming the Go vulnerability database. Nice work putting all the details together!

[gopherbot]

This PR (HEAD: 0c9a483) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/vulndb/+/806240.

Important tips:

• Don't comment on this PR. All discussion takes place in Gerrit.
• You need a Gmail or other Google account to log in to Gerrit.
• To change your code in response to feedback:
  • Push a new commit to the branch used by your GitHub PR.
  • A new "patch set" will then appear in Gerrit.
  • Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
  • Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
  • Multiple commits in the PR will be squashed by GerritBot.
• The title and description of the GitHub PR are used to construct the final commit message.
  • Edit these as needed via the GitHub web interface (not via Gerrit or git).
  • You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
• See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

[gopherbot]

Message from Gopher Robot:

Patch Set 1:

(1 comment)

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/806240.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from Gopher Robot:

Patch Set 1:

Congratulations on opening your first change. Thank you for your contribution!

Next steps:
A maintainer will review your change and provide feedback. See
https://go.dev/doc/contribute#review for more info and tips to get your
patch through code review.

Most changes in the Go project go through a few rounds of revision. This can be
surprising to people new to the project. The careful, iterative review process
is our way of helping mentor contributors and ensuring that their contributions
have a lasting impact.

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/806240.
After addressing review feedback, remember to publish your drafts!