AI agent vulnerability · Open WebUI

CVE-2024-12537: Open WebUI Uncontrolled Resource Consumption vulnerability

highCVSS 3.0 7.5GHSA-chf7-q7m5-fq92

In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely unresponsive.

Published Mar 20, 2025 · Updated Apr 1, 2025

Affected packages

open-webui

Ecosystem: PyPI
Affected: <= 0.3.32
Fixed in: No patched version yet
Check: pip show open-webui

open-webui

Ecosystem: npm
Affected: <= 0.3.32
Fixed in: No patched version yet
Check: npm ls open-webui

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely unresponsive. This could lead to severe performance issues, causing the server to become unresponsive or experience significant degradation, ultimately resulting in service interruptions for legitimate users.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Open WebUI vulnerabilities

All Open WebUI entries