GHSA-g3mx-83mp-3rwc json
Open WebUI Uncontrolled Resource Consumption vulnerability
published last yr. modified 4mo ago also CVE-2024-12534 , PYSEC-2026-1733
- cvss
- 7.5
- version 3.0, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
In version v0.3.32 of open-webui/open-webui, the application allows users to submit large payloads in the email and password fields during the sign-in process due to the lack of character length validation on these inputs. This vulnerability can lead to a Denial of Service (DoS) condition when a user submits excessively large strings, exhausting server resources such as CPU, memory, and disk space, and rendering the service unavailable for legitimate users. This makes the server susceptible to resource exhaustion attacks without requiring authentication.
Is GHSA-g3mx-83mp-3rwc in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | open-webui | <=0.3.32 |
no fix listed |
| npm | open-webui | <=0.3.32 |
no fix listed |
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
nvd.nist.gov
/vuln/detail/CVE-2024-12534
advisory
-
github.com
/open-webui/open-webui
package
-
github.com
/open-webui/open-webui/blob/e8babe62bc8e466be0367703fd062a981f5c2394/src/lib/apis/auths/index.ts#L113-L142
web
-
huntr.com
/bounties/c7c0a4e6-acd3-49b4-8684-2c2c27014b76
web
-
pypi.org
/project/open-webui
package
-
github.com
/advisories/GHSA-g3mx-83mp-3rwc
advisory
Sources
- GitHub Advisory GHSA-g3mx-83mp-3rwc
- OSV PYSEC-2026-1733
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.