Uncontrolled Resource Consumption in Open WebUI Affects Server Memory

CVE-2026-109294

What is CVE-2026-109294?

Open WebUI versions prior to 0.11.4 are susceptible to an uncontrolled resource consumption vulnerability. Authenticated users can exploit this flaw by sending compressed remote image URLs in chat messages, leading to excessive memory usage on the server. The vulnerability enables attackers to redirect the image field to a host that returns gzip-encoded responses, which the system decompresses without constraints. This unbounded decompression process can ultimately result in denial of service, affecting all users of the platform.

References