CVE-2026-109298: Open WebUI: regex DoS via grep tools exhausts memory

Open WebUI 0.11.0 through 0.11.3 compiles user-chosen grep patterns in its knowledge and chat file search tools with a regex engine that expands nested counted repetition without limit and caches the result, so a short pattern can block the event loop and exhaust worker memory. Any authenticated low-privilege user can trigger it by getting the model to call grep_knowledge_files, so the barrier is an ordinary account, not admin rights. Exploitation is low-complexity, but there is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS score, so near-term mass exploitation looks unlikely. Because the cached result persists, a single bad pattern can degrade the whole instance and affect every user sharing the workers. Upgrade to Open WebUI 0.11.4 or later, and until then restrict registrations and monitor worker memory and event-loop latency.

No confirmed active exploitation of CVE-2026-109298 has been reported, but organizations should still patch proactively.

1) Upgrade open-webui to 0.11.4 or later (fix commit 97e013a6). 2) Until patched, disable or restrict the knowledge and chat file grep tools, for example through tool and function permissions, and limit who can use knowledge bases. 3) Disable open self-registration and review low-privilege accounts. 4) Set container memory limits and restart policies, and run multiple workers behind a health-checked proxy. 5) Detect: alert on event-loop latency spikes, worker memory growth and OOM restarts, and review logs for grep_knowledge_files calls with patterns containing nested quantifiers such as (a{1000}){1000}. 6) Rate-limit authenticated API usage per account.

This vulnerability affects the following AI/ML architecture patterns: LLM chat web interfaces, RAG pipelines, Agent tool-calling frameworks, Self-hosted model front-ends.

CVE-2026-109298 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.47%.