CVE-2026-109294

CVSS 7.1 (high) · published 2026-10-12

Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, which get_image_base64_from_url decompresses unbounded, causing denial of service for all users.

Weakness: CWE-400, CWE-409

Source: NVD CVE-2026-109294

References

• https://github.com/open-webui/open-webui/security/advisories/GHSA-w8j8-jv6j-3m47
• https://www.vulncheck.com/advisories/open-webui-0.6.42-before-0.11.4-memory-exhaustion-via-compressed-remote-image

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.