Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image
Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, which get_image_base64_from_url decompresses unbounded, causing denial of service for all users.
CVE-2026-109294
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-109294
open-webui
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "open-webui",
"product": "open-webui",
"versions": [
{
"status": "affected",
"version": "0.6.42",
"lessThan": "0.11.4",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
],
"packageURL": "pkg:pypi/open-webui",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-109294
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #53315 · Revision 1
- Added to Heist Feed
- Publisher date