PT-2025-12199 · Unknown · Open-Webui

Published

2024-10-04

·

Updated

2025-07-21

·

CVE-2024-7983

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions open-webui version 0.3.8
Description An endpoint for converting Markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes unresponsive to other requests until the conversion is complete. The vulnerable endpoint is /convert-markdown-to-html. The malicious payload utilizes Markdown to cause excessive processing time.
Recommendations Disable the /convert-markdown-to-html endpoint to prevent unauthorized access and potential denial-of-service attacks.

Exploit

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400CWE-770

Related Identifiers

CVE-2024-7983
GHSA-5V9M-57MQ-QC75
MGASA-2024-0321

Affected Products

Open-Webui