GHSA-6wj5-5pgr-jwq8 json
Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability in api/chat/file
published last yr. modified last yr.
- cvss
- 7.5
- version 3.0, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
A vulnerability in open-webui/open-webui version 79778fa allows an attacker to cause a Denial of Service (DoS) by uploading a file with a malformed multipart boundary. By appending a large number of characters to the end of the multipart boundary, the server continuously processes each character, rendering the application inaccessible. This issue can prevent all users from accessing the application until the server recovers.
Patch / fix
Is GHSA-6wj5-5pgr-jwq8 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | open-webui | <0.4.7 |
0.4.7 |
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/open-webui/open-webui/commit/f311c03a21dc09e279a0cad7482a68b273517baf
web
-
github.com
/Kludex/python-multipart/security/advisories/GHSA-59g5-xgcq-4qw3
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-53981
advisory
-
github.com
/open-webui/open-webui
package
-
huntr.com
/bounties/15eb4fbe-70d4-420e-806a-ec6f4ecb7202
web
Sources
- GitHub Advisory GHSA-6wj5-5pgr-jwq8
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.