PT-2025-12201 · Unknown · Open-Webui

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-7999

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 79778fa

Description A vulnerability allows an attacker to cause a Denial of Service (DoS) by uploading a file with a malformed multipart boundary. By appending a large number of characters to the end of the multipart boundary, the server continuously processes each character, rendering the application inaccessible. This issue can prevent all users from accessing the application until the server recovers.

Recommendations For open-webui/open-webui version 79778fa, as a temporary workaround, consider restricting file uploads or validating the multipart boundary to prevent malicious uploads until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-7999

GHSA-6WJ5-5PGR-JWQ8

Affected Products

Open-Webui

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-7999 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-53981 · Security Note
• https://osv.dev/vulnerability/GHSA-6wj5-5pgr-jwq8 · Vendor Advisory
• https://github.com/open-webui/open-webui · Note
• https://github.com/open-webui/open-webui/commit/f311c03a21dc09e279a0cad7482a68b273517baf · Note
• https://github.com/Kludex/python-multipart/security/advisories/GHSA-59g5-xgcq-4qw3 · Note
• https://huntr.com/bounties/15eb4fbe-70d4-420e-806a-ec6f4ecb7202 · Note
• https://twitter.com/CVEnew/status/1902968899064435029 · Twitter Post