Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/open_webui/utils/misc.py advanced through a chat history by map key but tracked visited entries using each message body's optional id field. An authenticated user could store id-less messages in a parent cycle and trigger a non-terminating walk that blocked the async event loop, grew memory until termination, and remained persistent across process restarts. This issue is fixed in version 0.11.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-09T22:18:49.080Z",
  "pubdate": "2026-09-09T22:18:49.080Z",
  "executiveSummary": "Open WebUI versions 0.5.0 through 0.11.1 are susceptible to an algorithmic complexity vulnerability located within the message-chain reconstruction logic.\nThis vulnerability is classified as a Denial of Service (DoS) condition, enabling an authenticated attacker to exhaust system resources, specifically memory, and block the asynchronous event loop.\nThe flaw stems from improper validation and tracking of message history during chain reconstruction, allowing for the creation of cyclic, non-terminating reference paths.\nBy injecting id-less messages into a parent cycle, an attacker can trigger infinite recursion or iterative processing loops that cause persistent instability.\nThe impact is severe, as the resulting state remains persistent across process restarts, potentially leading to a permanent DoS of the affected platform instance.\nSuccessful exploitation requires authenticated access to the system, but does not necessitate elevated administrative privileges, making it a significant risk for multi-user deployments.",
  "technicalDetails": "The vulnerability resides in backend/open_webui/utils/misc.py within the message-chain reconstruction helper mechanism.\nThe root cause is a flaw in the logic used to traverse chat histories; while the application traverses messages via map keys, it relies on an optional 'id' field within the message body to track visited entries and prevent cycles.\nBy crafting an input payload containing id-less messages, an attacker can circumvent the visitation tracking mechanism.\nWhen the reconstruction utility processes a chat history containing these malicious, id-less messages arranged in a circular dependency (a parent cycle), the traversal logic fails to reach a terminal state.\nThis results in a non-terminating walk through the message chain. Because the process is executing within an asynchronous event loop, the infinite processing consumes available CPU resources and leads to continuous memory growth.\nThe impact is compounded by the fact that this chat history state is persisted by the application; consequently, upon restarting the service, the application attempts to reconstruct the poisoned message chain, causing the event loop to block again and preventing the system from returning to a functional state.\nTo exploit this, an authenticated user must trigger the saving of a message structure that introduces a cycle without sufficient identifier metadata. Once the state is stored, the reconstruction function is invoked, leading to the exhaustion of resources.\nThis vulnerability effectively renders the application unavailable to all users, as the underlying async worker becomes perpetually stuck, unable to process new requests or maintain existing connections."
}