CVE-2026-109294: Open WebUI: gzip bomb via image URL causes DoS

MEDIUM

Published October 12, 2026

CISO Take

Open WebUI versions 0.6.42 up to (but not including) 0.11.4 decompress remote image responses without a size limit, so any authenticated user can point a chat message's image field at a host serving a gzip bomb and exhaust server memory, taking the platform down for everyone. The CVSS score is a moderate 6.5 because it needs a valid account and affects availability only, with no confidentiality or integrity impact. There is no EPSS data, no KEV listing, no public exploit and no Nuclei template, so the likelihood of exploitation is currently low, but the attack is trivial to build and open-webui has 186 other CVEs on record, which signals a heavily scrutinized codebase. Upgrade to 0.11.4 or later, and until then limit who can register or sign in, and cap container memory so an OOM kill stays contained to Open WebUI rather than the host.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

Medium overall. Exploitation is low complexity and network-reachable, but it requires a low-privileged authenticated account. Impact is limited to availability, though it is service-wide: one account can crash the process and affect all users. Risk rises for deployments with open self-registration, shared multi-tenant instances, or internet exposure, and is lower for single-user or tightly access-controlled internal deployments. No active exploitation, public PoC or scanner template has been observed (CISA SSVC and EPSS are unavailable).

How does the attack unfold?

Initial Access

Attacker signs in with a low-privileged account on the Open WebUI instance.

AML.T0012

Payload Staging

Attacker hosts a gzip-encoded response that expands to a very large size on a server they control.

AML.T0079

Exploitation

Attacker submits a chat message with the image field pointing to the URL, and get_image_base64_from_url decompresses it without limit.

AML.T0049

Impact

Server memory is exhausted and the process is killed, denying chat service to all users.

AML.T0029

Initial Access

Attacker signs in with a low-privileged account on the Open WebUI instance.

AML.T0012

Payload Staging

Attacker hosts a gzip-encoded response that expands to a very large size on a server they control.

AML.T0079

Exploitation

Attacker submits a chat message with the image field pointing to the URL, and get_image_base64_from_url decompresses it without limit.

AML.T0049

Impact

Server memory is exhausted and the process is killed, denying chat service to all users.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
156.7K3 dependentsPushed 6d ago76% patched~20d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade open-webui (pip) to 0.11.4 or later. 2) Until patched, disable or restrict open user registration and review accounts with chat access. 3) Set container or cgroup memory limits and a restart policy (for example Docker mem_limit with restart: unless-stopped) so an OOM event is contained and self-recovers. 4) Restrict egress from the Open WebUI host to approved destinations where feasible, which limits attacker-controlled hosts serving compressed payloads. 5) Detect: alert on sudden memory growth or OOM kills of the Open WebUI process, and on chat requests whose image fields contain external URLs, especially from newly created or unusual accounts. 6) Review the vendor advisory GHSA-w8j8-jv6j-3m47 for further guidance.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSFrameworkAPIAML.T0029- Denial of AI Service AML.T0034.001- Resource-Intensive Queries AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to risks and unknown risks

OWASP LLM Top 10

LLM10:2025-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-109294?

Is CVE-2026-109294 actively exploited?

No confirmed active exploitation of CVE-2026-109294 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-109294?

1) Upgrade open-webui (pip) to 0.11.4 or later. 2) Until patched, disable or restrict open user registration and review accounts with chat access. 3) Set container or cgroup memory limits and a restart policy (for example Docker mem_limit with restart: unless-stopped) so an OOM event is contained and self-recovers. 4) Restrict egress from the Open WebUI host to approved destinations where feasible, which limits attacker-controlled hosts serving compressed payloads. 5) Detect: alert on sudden memory growth or OOM kills of the Open WebUI process, and on chat requests whose image fields contain external URLs, especially from newly created or unusual accounts. 6) Review the vendor advisory GHSA-w8j8-jv6j-3m47 for further guidance.

What systems are affected by CVE-2026-109294?

This vulnerability affects the following AI/ML architecture patterns: LLM chat front ends, Self-hosted model serving gateways, RAG pipelines, Multi-user AI workspaces.

What is the CVSS score for CVE-2026-109294?

CVE-2026-109294 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.31%.

What is the AI security impact?

Affected AI Architectures

LLM chat front endsSelf-hosted model serving gatewaysRAG pipelinesMulti-user AI workspaces

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0034.001Resource-Intensive Queries

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, which get_image_base64_from_url decompresses unbounded, causing denial of service for all users.

Exploitation Scenario

An attacker registers (or uses a low-privileged account on) a shared Open WebUI instance. They host a small gzip file on a server they control that expands to many gigabytes and responds with Content-Encoding: gzip. They send a chat message whose image field references that URL. The server fetches the URL and decompresses the response in memory without limit, exhausting RAM until the process is OOM-killed. The attacker repeats the request after each restart to keep the internal AI chat service down for all users.

Weaknesses (CWE)

CWE-400Uncontrolled Resource Consumption CWE-409Improper Handling of Highly Compressed Data (Data Amplification)

CWE-400 — Uncontrolled Resource Consumption: The product does not properly control the allocation and maintenance of a limited resource.

[Architecture and Design] Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
[Architecture and Design] Mitigation of resource exhaustion attacks requires that the target system either: The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker. recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.

Source: MITRE CWE corpus.