CVE-2026-109298
Received Received - Intake

Open WebUI Regex Engine ReDoS Vulnerability

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grep_knowledge_files with short nested-repetition patterns, blocking the event loop and exhausting worker memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109298
EUVD
EUVD-2026-97600

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
open-webui open-webui 0.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Open WebUI versions 0.11.0 to 0.11.3. It involves a memory exhaustion issue where authenticated users can send short nested-repetition patterns to the grep_knowledge_files function. The regex engine compiles these patterns with unbounded nested counted repetition, caching the result and blocking the event loop while exhausting worker memory.

Detection Guidance

Check Open WebUI version with 'pip show open-webui' or 'docker inspect <container>'. If version is 0.11.0 to 0.11.3, the system is vulnerable. Monitor for high memory usage during knowledge or chat file searches.

Impact Analysis

An attacker with default user permissions can upload a file and instruct the model to search using a crafted pattern like ((((a{40}){40}){40}){40})|x. This causes the worker to allocate excessive memory, delaying other requests and potentially crashing the worker if memory limits are exceeded.

Mitigation Strategies

Upgrade Open WebUI to version 0.11.4 or later immediately. If upgrading is not possible, restrict authenticated user access to search functionality or disable knowledge/chat file search tools temporarily.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109298. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart