CVE-2026-109294
Received Received - Intake

Uncontrolled Memory Exhaustion in Open WebUI via Compressed Image URLs

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, which get_image_base64_from_url decompresses unbounded, causing denial of service for all users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109294
EUVD
EUVD-2026-97596

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
open-webui open-webui 0.6.42

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an uncontrolled resource consumption issue in Open WebUI versions 0.6.42 through 0.11.3. Authenticated users can send chat messages with compressed remote image URLs. The server decompresses gzip-encoded responses without size limits, causing excessive memory usage and denial of service for all users.

Detection Guidance

Monitor server memory usage spikes during user activity, especially when compressed remote images are processed. Check Open WebUI logs for unusually large image fetches or memory errors. Use system tools like 'top', 'htop', or 'ps' to track memory consumption by the Open WebUI process.

Impact Analysis

An attacker could crash the Open WebUI server by sending a specially crafted message, making the service unavailable for all users. Even a small compressed payload can expand into hundreds of megabytes of memory usage, disrupting normal operations.

Mitigation Strategies

Upgrade Open WebUI to version 0.11.4 or later immediately. Block or restrict access to compressed remote image URLs in chat messages. Implement rate limiting for image fetches and monitor for unusual memory usage patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109294. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart