CVE-2026-109297
Received Received - Intake

Open WebUI Automation Recurrence-Rule Validator DoS

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rules (or, in 0.11.0, lowercase frequencies or omitted RRULE prefixes) that expand per-second synchronously, blocking the shared event loop for minutes per request and on every scheduler poll.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109297
EUVD
EUVD-2026-97599

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
open-webui open-webui 0.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Open WebUI 0.11.0 before 0.11.4 has a denial of service vulnerability in the automation recurrence-rule validator. The issue occurs because the validator parses rule text more strictly than the calendar library that executes it. Users with permission to create automations can submit crafted rules that cause excessive processing, blocking the shared event loop for extended periods.

Detection Guidance

To detect this vulnerability, check the Open WebUI version running on your system. Versions 0.11.0 through 0.11.3 are vulnerable. Use commands like 'docker ps' or 'kubectl get pods' to inspect container versions if deployed in a containerized environment. Look for logs indicating event loop stalls or scheduler delays during automation rule processing.

Impact Analysis

This vulnerability allows attackers with automation creation privileges to disrupt service availability by submitting specially crafted rules. The excessive processing can slow down or crash the system, affecting all users relying on the shared event loop.

Compliance Impact

This vulnerability primarily impacts availability by causing denial-of-service conditions, which could lead to service disruptions. For GDPR, this may affect the right to access or rectify data if systems become unavailable. HIPAA requires timely access to protected health information; prolonged downtime could violate this requirement.

Mitigation Strategies

Upgrade Open WebUI to version 0.11.4 or later to address the denial of service vulnerability in the automation recurrence-rule validator.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109297. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart