GitHub Advisoryadvisory · PyPI, npm

GHSA-chf7-q7m5-fq92 Open WebUI Uncontrolled Resource Consumption vulnerability

HIGH Published 2025-03-20 Modified 2025-03-21 Official page ↗
Aliases
CVE-2024-12537
Ecosystem
PyPI, npm
Packages
open-webui
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-770
Reviewed
2025-03-21

Affected packages

• PyPI open-webui: <= 0.3.32 (no fix yet) • npm open-webui: <= 0.3.32 (no fix yet)

Description

In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the `api/v1/utils/code/format` endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely unresponsive. This could lead to severe performance issues, causing the server to become unresponsive or experience significant degradation, ultimately resulting in service interruptions for legitimate users.

Related

Alias · not in database (1)

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References