CVE-2026-109294

Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image

State: Published
Severity: 7.1 High
Published: Oct 12, 2026
Updated: Oct 23, 2026
Reserved: Oct 12, 2026

Description

Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, which get_image_base64_from_url decompresses unbounded, causing denial of service for all users.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	VulnCheck

Weaknesses

CWE-400 Uncontrolled Resource Consumption
CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

Affected Products

Product	Versions
open-webuiopen-webui	0.6.42 to before 0.11.4Affected 0.11.4Not affected

References

GitHub Security Advisory (GHSA-w8j8-jv6j-3m47)vendor-advisory
VulnCheck Advisory: Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Imagethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.