EUVD-2026-42621
GHSA-ffpj-xv5c-p3gw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable chat endpoint requires only a low-privilege authenticated session; no confidentiality or integrity impact, sole effect is event-loop availability loss.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.2 before 0.10.0, the SKILL_MENTION_RE and strip_re regular expressions in backend/open_webui/utils/middleware.py parsed <$skillId|label> skill mentions with overlapping quantifiers, allowing an authenticated chat message containing <$ without a closing > to trigger quadratic backtracking and block the asyncio event loop. This issue is fixed in version 0.10.0.
AnalysisAI
Regular expression denial of service in Open WebUI 0.9.2-0.9.x allows any authenticated user to block the Python asyncio event loop by sending a single malformed chat message. The SKILL_MENTION_RE and strip_re patterns in middleware.py use overlapping quantifiers when parsing skill-mention syntax, causing quadratic backtracking on input containing '<$' without a closing '>'. Because the event loop is synchronously blocked, the attack effectively takes the entire Open WebUI instance offline for all concurrent users. No public exploit code or active exploitation has been identified at time of analysis; the fix is confirmed in the v0.10.0 release.
Technical ContextAI
CWE-1333 (Inefficient Regular Expression Complexity) describes vulnerabilities where a crafted input causes a regular expression engine to explore an exponential number of possible match paths. Here, SKILL_MENTION_RE and strip_re in backend/open_webui/utils/middleware.py are designed to parse skill-mention tokens of the form '<$skillId|label>'. Their overlapping quantifiers mean that input like '<$' - an opening delimiter with no closing '>' - forces the Python 're' module (which uses backtracking rather than an NFA/DFA engine) into quadratic or worse time complexity. Since Open WebUI is built on an asyncio-based Python backend, blocking the event loop inside a synchronous regex call halts all concurrent coroutines, not just the caller's request. The affected product is cpe:2.3:a:open-webui:open-webui:*:*:*:*:*:*:*:* covering versions 0.9.2 up to (but not including) 0.10.0.
RemediationAI
Upgrade to Open WebUI v0.10.0, which contains the confirmed fix per commit 61a26722155ec6ee1b629cf8dfcf975098c18331 and the release at https://github.com/open-webui/open-webui/releases/tag/v0.10.0. If immediate upgrade is not possible, the most effective compensating control is restricting the ability to create or use authenticated accounts - disabling self-registration reduces the attacker pool to already-trusted users. Alternatively, placing a reverse proxy (e.g., nginx) with per-user request rate limiting in front of the chat endpoint can limit repeated triggering, though it does not prevent a single blocking request from stalling the event loop momentarily. Network-layer controls (firewall rules) offer no mitigation since the issue requires only authenticated HTTP access. Side effect of disabling self-registration: reduces accessibility for legitimate users in open-community deployments.
More in Open Webui
View allA vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session
An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui
A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Sit
Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traver
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a St
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Se
A stored cross-site scripting (XSS) vulnerability exists in open-webui/open-webui version 0.3.8. Rated high severity (CV
In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing u
OAuth and SCIM identity confusion in Open WebUI 0.6.41-0.10.x (SQLite-backed deployments only) allows unauthenticated re
In open-webui version 0.3.8, the endpoint `/models/upload` is vulnerable to arbitrary file write due to improper handlin
The `/openai/models` endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery (SSRF)
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today