Open WebUIGHSA-chf7-q7m5-fq92
Open WebUI Uncontrolled Resource Consumption vulnerability
High7.5CVE-2024-12537 · Published Mar 20, 2025 · updated Jul 7, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| open-webui PyPI | <= 0.3.32 | No fix yet |
Details and references
In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the `api/v1/utils/code/format` endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely unresponsive. This could lead to severe performance issues, causing the server to become unresponsive or experience significant degradation, ultimately resulting in service interruptions for legitimate users.
More Open WebUI advisories
All Open WebUI| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 202025 | Open WebUI Uncontrolled Resource Consumption vulnerability CVE-2024-12534High7.5no fix yet | High7.5 | No fix yet |
| Mar 202025 | Open WebUI has vulnerable dependency on starlette via fastapi GHSA-w466-2wfc-8g58High7.5no fix yet | High7.5 | No fix yet |
| Mar 202025 | Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload CVE-2024-7044Medium6.8no fix yet | Medium6.8 | No fix yet |
| Mar 202025 | Open WebUI Allows Arbitrary File Reading and Deletion CVE-2024-7043High8.1no fix yet | High8.1 | No fix yet |
| Mar 202025 | Open WebUI Uncontrolled Resource Consumption vulnerability CVE-2024-7036High7.5no fix yet | High7.5 | No fix yet |
| Mar 202025 | Open WebUI Vulnerable to a Session Fixation Attack CVE-2024-7053High7.6no fix yet | High7.6 | No fix yet |