AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

Open WebUIGHSA-wcwp-9rcp-jvfg

Open WebUI Uncontrolled Resource Consumption vulnerability

Open WebUI

CVE-2024-7036 · Published Mar 20, 2025 · updated Jul 7, 2026

High7.5
No fix yet
GitHub advisory

A vulnerability in open-webui/open-webui v0.3.8 allows an unauthenticated attacker to sign up with excessively large text in the 'name' field, causing the Admin panel to become unresponsive. This prevents administrators from performing essential user management actions such as deleting, editing, or adding users. The vulnerability can also be exploited by authenticated users with low privileges, leading to the same unresponsive state in the Admin panel.

Affected versions

PackageAffectedFixed in
open-webui
PyPI
<= 0.3.8No fix yet
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-400
Also known as
CVE-2024-7036, PYSEC-2026-1742

More Open WebUI advisories

All Open WebUI