Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109294Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in open-webui from open-webui. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 76.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, which get_image_base64_from_url decompresses unbounded, causing denial of service for all users.

Affected products (as reported)

Vendor	Product	Versions
open-webui	open-webui	0.6.42 – before 0.11.4

Weakness: CWE-400, CWE-409 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-w8j8-jv6j-3m47) vendor-advisory
VulnCheck Advisory: Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image third-party-advisory