Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability in api/chat/file
Priority LOW 38CWE-400Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-400.
Summary
A vulnerability in open-webui/open-webui version 79778fa allows an attacker to cause a Denial of Service (DoS) by uploading a file with a malformed multipart boundary. By appending a large number of characters to the end of the multipart boundary, the server continuously processes each character, rendering the application inaccessible. This issue can prevent all users from accessing the application until the server recovers.
Why it matters now
Fix Fixed open-webui (PyPI): 0.4.7
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | open-webui (PyPI) | before 0.4.7 | 0.4.7 | Patch available | GHSA-6wj5-5pgr-jwq8 |
- open-webui (PyPI) Vendor— Affected before 0.4.7 Fixed in 0.4.7 Patch available GHSA-6wj5-5pgr-jwq8
Remediation
- Fix · GHSA-6wj5-5pgr-jwq8 open-webui (PyPI) Fixed in 0.4.7 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-6wj5-5pgr-jwq8
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences