Open WebUI CVE-2026-109298

Requires an authenticated Open WebUI account (PR:L) with access to the knowledge-base or chat file-search tooling - specifically the ability to have the model call grep_knowledge_files or grep_chat_files. The limiting factor is authentication: anonymous/unauthenticated users cannot trigger it, and the tool must be reachable (knowledge or chat file search enabled). No user interaction beyond the attacker's own request is needed (UI:N), and default configurations of the vulnerable 0.11.0-0.11.3 versions are affected because the flaw is in the default regex compilation path, not an optional feature. Impact is limited to availability (service/worker DoS) with no data exposure.

This is a genuine but moderate-severity availability issue, not a high-impact priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) scores 7.1 and is internally consistent with the description: network-reachable, low complexity, but requiring low-level privileges (PR:L = an authenticated account) and producing only an availability impact (VA:H) with no confidentiality or integrity loss. This is a classic CWE-400 uncontrolled resource consumption / ReDoS-style compile-time blowup. Exploitation status: no public exploit identified at time of analysis - there is no CISA KEV listing, no EPSS score, and no POC referenced in the input, only a vendor advisory (GHSA-gww9-mhgj-pfqh) and the fixing commit. The source-code evidence strongly corroborates the mechanism: the fix replaces the backtracking regex engine with Google RE2 (linear-time, bounded compilation via max_mem = 1 MiB) and removes the prior fragile counted-quantifier validator, confirming the root cause is unbounded nested counted-repetition expansion at compile time. The practical risk is bounded by the authentication requirement - only users who already have an account and access to the knowledge/chat file-search tools can trigger it - so impact is limited to self-inflicted or malicious-insider denial of service against a shared instance. No conflicting signals between the vector and description were found.

An authenticated Open WebUI user (or a model acting on their behalf) issues a chat request that invokes the grep_knowledge_files or grep_chat_files tool with a short regex containing deeply nested counted repetition. Compiling that pattern with the old backtracking engine expands unbounded, blocking the asyncio event loop and exhausting the worker's memory, degrading or crashing service for all users on that instance. No public exploit code was identified in the provided data, and low attack complexity (AC:L) means a single crafted pattern suffices.