CVE-2026-109294

Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, which get_image_base64_from_url decompresses unbounded, causing denial of service for all users.

CVSS 4.0

7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-25)

CWEs

CWE-400, CWE-409

Published

2026-10-12

Modified

2026-10-23

Record from

the NVD, synced 2026-10-24

References

• https://github.com/open-webui/open-webui/security/advisories/GHSA-w8j8-jv6j-3m47
• https://www.vulncheck.com/advisories/open-webui-0.6.42-before-0.11.4-memory-exhaustion-via-compressed-remote-image

Check your stackJSON