Open WebUI Uncontrolled Resource Consumption vulnerability

Description

In version v0.3.32 of open-webui/open-webui, the application allows users to submit large payloads in the email and password fields during the sign-in process due to the lack of character length validation on these inputs.

Recommendation

No fix is available yet. Followings are affected versions:

<= 0.3.32

References

GHSA-g3mx-83mp-3rwc
huntr.com
CVE-2024-12534
CWE-400
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Open WebUI Uncontrolled Resource Consumption vulnerability and gives you actionable findings to investigate.

Start a free scan

Related Issues

Open WebUI Uncontrolled Resource Consumption vulnerability - open-webui - CVE-2024-12537
graphql Uncontrolled Resource Consumption vulnerability - CVE-2023-26144
Uncontrolled resource consumption in braces - CVE-2024-4068
Uncontrolled Resource Consumption in trim-off-newlines - CVE-2021-23425

Exploiting Server Version Disclosure

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

See something that needs correcting? Let us knowUpdated March 21, 2025