Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-109298 EUVD-2026-97600GHSA-x55j-pj79-2cgm

Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex

Published Oct 12, 2026 · Updated Oct 23, 2026 · Assigned by VulnCheck

Description

Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grep_knowledge_files with short nested-repetition patterns, blocking the event loop and exhausting worker memory.

Affected products

VendorProductAffectedFixed
open-webui open-webui 0.11.0 – < 0.11.4 0.11.4

References