Sign in
Deutsch English Español Polski
High

Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability

  • Disclosed: 20.03.2025
  • Updated: 11.10.2026 12:19

A Denial of Service (DoS) vulnerability exists in open-webui/open-webui version 0.3.21. This vulnerability affects multiple endpoints, including /ollama/models/upload, /audio/api/v1/transcriptions, and /rag/api/v1/doc. The application processes multipart boundaries without authentication, leading to resource exhaustion. By appending additional characters to the multipart boundary, an attacker can cause the server to parse each byte of the boundary, ultimately leading to service unavailability. This vulnerability can be exploited remotely, resulting in high CPU and memory usage, and rendering the service inaccessible to legitimate users.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package open-webui <= 0.3.21 no fix
Python (PyPI) open-webui <= 0.3.21 no fix

References

CVSS score 7.5/10
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE)
CWE-400
Platform
npm, Python (PyPI)
Package
open-webui
Disclosed
20.03.2025
Updated
11.10.2026 12:19

Sources and licenses

OSV / GitHub Advisory Database - GHSA-5ccf-884p-4jjq - CC BY 4.0

Vulnerability history: open-webui

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (161) in the archive
Total entries
161
First → latest
08.2024 09.2026
Without a fix
11
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 77
  • Medium 75
  • Low 8

Disclosures per year

Severity:
  1. Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability this entry
    High · 7.5 ghsa-5ccf-884p-4jjq <= 0.3.21 no fix
  2. Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
    High · 7.5 CVE-2026-87011 >= 0.9.0, < 0.11.1 0.11.1
  3. Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
    High · 8.1 CVE-2026-87016 >= 0.6.41, < 0.11.1 0.11.1
  4. Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
    High · 8.7 CVE-2026-87995 >= 0.8.11, < 0.11.1 0.11.1
  5. Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
    High · 7.7 CVE-2026-87996 >= 0.9.6, < 0.11.1 0.11.1
  6. Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
    High · 7.1 CVE-2026-87998 >= 0.10.0, < 0.11.1 0.11.1
  7. Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
    High · 7.1 CVE-2026-87999 < 0.11.1 0.11.1
  8. Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
    High · 8.1 CVE-2026-70494 >= 0.10.0, < 0.11.0 0.11.0
  9. Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
    High · 8.7 CVE-2026-70492 >= 0.10.0, < 0.11.0 0.11.0
  10. Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
    High · 8.2 CVE-2026-70486 >= 0.9.0, < 0.11.0 0.11.0
  11. Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
    High · 7.1 CVE-2026-70485 >= 0.9.0, < 0.11.0 0.11.0
  12. Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
    High · 8.1 CVE-2026-70482 >= 0.8.0, < 0.11.0 0.11.0
  13. Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
    High · 7.7 CVE-2026-70479 >= 0.9.6, < 0.11.0 0.11.0
  14. open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
    High · 7.7 CVE-2026-59221 >= 0.9.6, < 0.10.0 0.10.0
  15. Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)
    High · 8.0 CVE-2026-59224 < 0.10.0 0.10.0
  16. Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
    High · 7.7 CVE-2026-59216 < 0.10.0 0.10.0
  17. Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
    High · 7.1 CVE-2026-59714 >= 0.9.5, < 0.10.0 0.10.0
  18. Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
    High · 7.1 CVE-2026-59219 >= 0.9.0, < 0.10.0 0.10.0
  19. Open WebUI: Stored web worker XSS via Pyodide
    High · 7.3 CVE-2026-59214 < 0.10.0 0.10.0
  20. Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages
    High · 7.3 CVE-2026-26193 < 0.6.44 0.6.44
  21. Open WebUI vulnerable to Stored XSS via iFrame in citations model
    High · 7.3 CVE-2026-26192 < 0.7.0 0.7.0
Show more (20) Showing 21 of 78

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.