Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · Open WebUI

CVE-2024-7983: Open WebUI denial of service through endpoint for converting markdown

highCVSS 3.0 7.5GHSA-5v9m-57mq-qc75

In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes unresponsive to other requests until the conversion is complete.

Published Mar 20, 2025 · Updated Oct 15, 2025

Affected packages

open-webui

Ecosystem
PyPI
Affected
<= 0.3.8
Fixed in
No patched version yet
Check
pip show open-webui

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes unresponsive to other requests until the conversion is complete.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Open WebUI vulnerabilities

All Open WebUI entries