Open WebUI CVE-2026-109294

Requires a valid authenticated Open WebUI account (PR:L) with the ability to send chat messages containing an image URL field. The attacker must point the image field at a host under their control (or any host) that returns a gzip-encoded HTTP response, which get_image_base64_from_url decompresses without size limits. Exploitation is limited by the authentication requirement and by the need for the target instance to process the attacker-supplied remote image URL; impact is confined to availability (memory exhaustion / DoS), with no data exposure or modification. Affected versions are 0.6.42 up to but not including 0.11.4.

This is a moderate-severity, single-impact denial-of-service issue, not a critical priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) scores 7.1 and is internally consistent with the description: network-reachable, low complexity, but requiring low-level authentication (PR:L) and affecting availability only (VA:H) with no confidentiality or integrity impact. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The flaw was reported by VulnCheck with a published GitHub Security Advisory (GHSA-w8j8-jv6j-3m47), lending credibility to the technical details. Real-world risk is tempered by the authentication requirement - an attacker needs a valid account - and by the impact ceiling being availability only. There is no signal conflict in the provided data; the main gap is the absence of EPSS/KEV/POC signals, meaning likelihood of exploitation is unmeasured rather than confirmed low. Priority should be routine-to-elevated patching for internet-exposed or multi-tenant Open WebUI deployments where the authenticated-user population is large or untrusted.

An authenticated Open WebUI user sends a chat message containing an image field pointing to a server they control that returns a small gzip-compressed payload expanding to gigabytes. The get_image_base64_from_url function decompresses the response without bounds, consuming all server memory and denying service to every other user on the instance. No public proof-of-concept is referenced, but the attack requires only a valid account and a crafted HTTP response.