CyberRota Analysis
AI-GeneratedThe Open WebUI platform is vulnerable to a denial-of-service condition due to a flaw in the message-chain reconstruction helper, which allows authenticated users to create id-less messages that can cause a non-terminating loop, leading to excessive memory consumption and eventual application termination. This vulnerability affects versions 0.5.0 through 0.11.1 and should be prioritized by organizations using the platform to prevent potential service disruptions. Users are advised to upgrade to version 0.11.1 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/open_webui/utils/misc.py advanced through a chat history by map key but tracked visited entries using each message body's optional id field. An authenticated user could store id-less messages in a parent cycle and trigger a non-terminating walk that blocked the async event loop, grew memory until termination, and remained persistent across process restarts. This issue is fixed in version 0.11.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)