https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 15:29:36 +0000 https://db.gcve.eu/vuln/bdu:2026-14840 bdu:2026-14840 https://db.gcve.eu/vuln/bdu:2026-14840 https://db.gcve.eu/vuln/fkie_cve-2026-88002 <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/open_webui/utils/misc.py advanced through a chat history by map key but tracked visited entries using each message body&#39;s optional id field. An authenticated user could store id-less messages in a parent cycle and trigger a non-terminating walk that blocked the async event loop, grew memory until termination, and remained persistent across process restarts. This issue is fixed in version 0.11.1.</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/open_webui/utils/misc.py advanced through a chat history by map key but tracked visited entries using each message body&#39;s optional id field. An authenticated user could store id-less messages in a parent cycle and trigger a non-terminating walk that blocked the async event loop, grew memory until termination, and remained persistent across process restarts. This issue is fixed in version 0.11.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-88002 https://db.gcve.eu/vuln/ghsa-jqhh-cjmq-vmv6 <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat&#39;s message chain detected repeats using each message&#39;s own `id` field while moving through the history by map key, so a message that simply omitted `id` was never recorded as visited. A history whose messages referenced each other in a parent cycle therefore made the walk run forever. Any account with the default `user` role could store such a chat and trigger the walk, blocking the server for everyone.</p> <p>## Preconditions One account with the default `user` role. No administrator rights, no additional permissions, no configuration change and no non-default setting: creating a chat is available to every user out of the box. The attack runs entirely against the attacker&#39;s own chat, so no knowledge of any other user&#39;s data is needed. Instances where every account is trusted are affected in the sense that the fault is reachable, but require a user acting deliberately.</p> <p>## Impact The walk is synchronous and runs on the asyncio event loop, so while it spins, every request from every user is blocked, including unauthenticated `/health` and administrator endpoints. External health checks and orchestrator liveness probes fail alongside the UI. The list it appends to grows without bound, so a memory-capped deployment ends in an out-of-memory kill rather than a hang. The work is not cancelled when the client disconnects, so one fire-and-forget request is enough and the attacker can disco…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat&#39;s message chain detected repeats using each message&#39;s own `id` field while moving through the history by map key, so a message that simply omitted `id` was never recorded as visited. A history whose messages referenced each other in a parent cycle therefore made the walk run forever. Any account with the default `user` role could store such a chat and trigger the walk, blocking the server for everyone.</p> <p>## Preconditions One account with the default `user` role. No administrator rights, no additional permissions, no configuration change and no non-default setting: creating a chat is available to every user out of the box. The attack runs entirely against the attacker&#39;s own chat, so no knowledge of any other user&#39;s data is needed. Instances where every account is trusted are affected in the sense that the fault is reachable, but require a user acting deliberately.</p> <p>## Impact The walk is synchronous and runs on the asyncio event loop, so while it spins, every request from every user is blocked, including unauthenticated `/health` and administrator endpoints. External health checks and orchestrator liveness probes fail alongside the UI. The list it appends to grows without bound, so a memory-capped deployment ends in an out-of-memory kill rather than a hang. The work is not cancelled when the client disconnects, so one fire-and-forget request is enough and the attacker can disco…</p> https://db.gcve.eu/vuln/ghsa-jqhh-cjmq-vmv6 https://db.gcve.eu/vuln/pysec-2026-3879 <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat&#39;s message chain detected repeats using each message&#39;s own `id` field while moving through the history by map key, so a message that simply omitted `id` was never recorded as visited. A history whose messages referenced each other in a parent cycle therefore made the walk run forever. Any account with the default `user` role could store such a chat and trigger the walk, blocking the server for everyone.</p> <p>## Preconditions One account with the default `user` role. No administrator rights, no additional permissions, no configuration change and no non-default setting: creating a chat is available to every user out of the box. The attack runs entirely against the attacker&#39;s own chat, so no knowledge of any other user&#39;s data is needed. Instances where every account is trusted are affected in the sense that the fault is reachable, but require a user acting deliberately.</p> <p>## Impact The walk is synchronous and runs on the asyncio event loop, so while it spins, every request from every user is blocked, including unauthenticated `/health` and administrator endpoints. External health checks and orchestrator liveness probes fail alongside the UI. The list it appends to grows without bound, so a memory-capped deployment ends in an out-of-memory kill rather than a hang. The work is not cancelled when the client disconnects, so one fire-and-forget request is enough and the attacker can disco…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary Chat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat&#39;s message chain detected repeats using each message&#39;s own `id` field while moving through the history by map key, so a message that simply omitted `id` was never recorded as visited. A history whose messages referenced each other in a parent cycle therefore made the walk run forever. Any account with the default `user` role could store such a chat and trigger the walk, blocking the server for everyone.</p> <p>## Preconditions One account with the default `user` role. No administrator rights, no additional permissions, no configuration change and no non-default setting: creating a chat is available to every user out of the box. The attack runs entirely against the attacker&#39;s own chat, so no knowledge of any other user&#39;s data is needed. Instances where every account is trusted are affected in the sense that the fault is reachable, but require a user acting deliberately.</p> <p>## Impact The walk is synchronous and runs on the asyncio event loop, so while it spins, every request from every user is blocked, including unauthenticated `/health` and administrator endpoints. External health checks and orchestrator liveness probes fail alongside the UI. The list it appends to grows without bound, so a memory-capped deployment ends in an out-of-memory kill rather than a hang. The work is not cancelled when the client disconnects, so one fire-and-forget request is enough and the attacker can disco…</p> https://db.gcve.eu/vuln/pysec-2026-3879