Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability

Description

A Denial of Service (DoS) vulnerability exists in open-webui/open-webui version 0.3.21. This vulnerability affects multiple endpoints, including /ollama/models/upload, /audio/api/v1/transcriptions, and /rag/api/v1/doc. The application processes multipart boundaries without authentication, leading to resource exhaustion.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.3.21

References

• GHSA-5ccf-884p-4jjq
• huntr.com
• CWE-400

Related Issues

• Denial of Service (DoS) vulnerability in RSSHub - CVE-2022-31110
• Open WebUI Uncontrolled Resource Consumption vulnerability - CVE-2024-12534
• Open WebUI Uncontrolled Resource Consumption vulnerability - open-webui - CVE-2024-12537
• prismjs Regular Expression Denial of Service vulnerability - CVE-2021-3801

You might also like:

These 7 PHP mistakes leave your website open to the hackers

CSRF, XXE, and 12 Other Security Acronyms Explained

Update Cheat Sheet for Developers

Tags:

npm

open-webui