AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Open WebUIGHSA-6wj5-5pgr-jwq8

Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability in api/chat/file

Open WebUI

Published Mar 20, 2025 · updated Apr 15, 2025

High7.5
Fix: upgrade to 0.4.7 or later
GitHub advisory

A vulnerability in open-webui/open-webui version 79778fa allows an attacker to cause a Denial of Service (DoS) by uploading a file with a malformed multipart boundary. By appending a large number of characters to the end of the multipart boundary, the server continuously processes each character, rendering the application inaccessible. This issue can prevent all users from accessing the application until the server recovers.

Affected versions

PackageAffectedFixed in
open-webui
PyPI
< 0.4.70.4.7
Details and references

More Open WebUI advisories

All Open WebUI