AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Open WebUIGHSA-chf7-q7m5-fq92

Open WebUI Uncontrolled Resource Consumption vulnerability

Open WebUI

CVE-2024-12537 · Published Mar 20, 2025 · updated Jul 7, 2026

High7.5
No fix yet
GitHub advisory

In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely unresponsive. This could lead to severe performance issues, causing the server to become unresponsive or experience significant degradation, ultimately resulting in service interruptions for legitimate users.

Affected versions

PackageAffectedFixed in
open-webui
PyPI
<= 0.3.32No fix yet
Details and references

More Open WebUI advisories

All Open WebUI