Regular Expression Denial of Service in Open WebUI by Open WebUI

CVE-2026-109295

What is CVE-2026-109295?

Open WebUI versions prior to 0.11.4 are susceptible to a regular expression denial of service (ReDoS) vulnerability. Authenticated users can exploit the vulnerability by using excessively complex regex in file search patterns, specifically through functions like grep_knowledge_files or grep_chat_files. This can lead to catastrophic backtracking, causing the event loop to stall for two seconds with each repeated call, which could severely hinder the performance and responsiveness of the server.

References