PT-2025-12292 · Unknown · Open-Webui

Published 2025-03-20 · Updated 2025-03-22 · CVE-2024-9840

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.21

Description A Denial of Service (DoS) issue exists, affecting multiple endpoints, including "/ollama/models/upload", "/audio/api/v1/transcriptions", and "/rag/api/v1/doc". The application processes multipart boundaries without authentication, leading to resource exhaustion. By appending additional characters to the multipart boundary, an attacker can cause the server to parse each byte of the boundary, ultimately leading to service unavailability. This issue can be exploited remotely, resulting in high CPU and memory usage, and rendering the service inaccessible to legitimate users.

Recommendations For open-webui/open-webui version 0.3.21, consider implementing authentication for multipart boundary processing to prevent unauthorized access and resource exhaustion. As a temporary workaround, restrict access to the affected endpoints to minimize the risk of exploitation.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-9840

GHSA-5CCF-884P-4JJQ

Affected Products

Open-Webui

References · 7

• https://osv.dev/vulnerability/GHSA-5ccf-884p-4jjq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9840 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-53981 · Security Note
• https://github.com/open-webui/open-webui · Note
• https://github.com/Kludex/python-multipart/security/advisories/GHSA-59g5-xgcq-4qw3 · Note
• https://huntr.com/bounties/9178f09e-4d4f-4a5b-bc32-cada7445b03c · Note
• https://twitter.com/CVEnew/status/1903336825244078148 · Twitter Post