CVE-2026-59220: Open WebUI ReDoS — MEDIUM

Q: Is CVE-2026-59220 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-59220, increasing the risk of exploitation.

Q: How to fix CVE-2026-59220?

1) Patch to Open WebUI 0.10.0 immediately — this fixes both the SKILL_MENTION_RE and strip_re patterns in backend/open_webui/utils/middleware.py. 2) If immediate patching isn't possible, add a reverse-proxy/WAF rule to flag or reject chat payloads containing an unclosed "<$" sequence, and cap maximum chat message length. 3) Detection: monitor event-loop lag / response-latency metrics for spikes correlated with chat message submissions, and audit access logs for repeated "<$" patterns in message bodies. 4) As a structural mitigation (not a fix), run multiple worker processes/replicas behind a load balancer so one stalled event loop doesn't take down the entire service. 5) Restrict access to trusted/vetted accounts on instances where a single-user DoS is unacceptable.

Q: What systems are affected by CVE-2026-59220?

This vulnerability affects the following AI/ML architecture patterns: Self-hosted LLM chat UI / front-end, Model serving / inference gateway, Multi-user AI platforms.

Q: What is the CVSS score for CVE-2026-59220?

CVE-2026-59220 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.57%.

CISO Take

Open WebUI's skill-mention parser uses regular expressions with overlapping quantifiers that can be forced into catastrophic backtracking: an authenticated user simply sends a chat message containing an unclosed "<$" skill tag, and the single asyncio event loop that serves the entire self-hosted instance freezes for every user, session, and API call until the request times out or the process is restarted. This matters for AI platform operators because Open WebUI is a widely deployed self-hosted LLM front end, and the flaw needs nothing more than a standard authenticated account (PR:L, no admin rights, no victim interaction) to knock a whole deployment offline — a classic low-skill availability hit rather than a data-loss issue (CVSS 6.5, C:N/I:N/A:H). Exploitation likelihood is currently low: EPSS sits at 0.295% (79th percentile), there is no CISA KEV listing, no public PoC, and no Nuclei template, so this is not an active-exploitation emergency — but the trivial trigger (any logged-in user, one crafted message) makes it an easy DoS lever for a disgruntled insider or a compromised low-privilege account. Upgrade to Open WebUI 0.10.0, which fixes the SKILL_MENTION_RE and strip_re patterns in backend/open_webui/utils/middleware.py; until patched, filter or rate-limit chat payloads containing unclosed "<$" sequences and watch for event-loop latency spikes correlated with chat submissions.

Sources: NVD GitHub Advisory EPSS ATLAS github.com/open-webui

What is the risk?

Despite a moderate CVSS score (6.5), real-world risk is currently low: no CISA KEV listing, no public exploit code, no Nuclei template, and an EPSS score in the 79th percentile (not the highest-priority tier). What elevates operational concern above the raw score is the trivial exploitation bar — any authenticated, low-privileged user (PR:L, no UI needed from a victim) can trigger it with a single crafted chat message, no AI/ML expertise required (sophistication: trivial). Because Open WebUI typically runs a shared asyncio event loop per worker, the blast radius is the entire instance, not just the attacker's session, which is unusual for a 'medium' severity finding. The package itself carries 130 other recorded CVEs, suggesting an actively scrutinized but historically vulnerability-prone codebase — patch cadence matters here.

How does the attack unfold?

Authenticated Chat Access

Attacker uses a standard, low-privileged Open WebUI account (or one obtained via credential compromise) to open a chat session with the target instance.

AML.T0012

Malicious Skill Mention Payload

Attacker sends a chat message containing an unclosed "<$" skill-mention tag crafted to trigger catastrophic backtracking in SKILL_MENTION_RE/strip_re.

AML.T0049

Event Loop Exhaustion

The regex engine's quadratic backtracking consumes CPU inside the shared asyncio event loop, blocking all other coroutines from making progress.

AML.T0029

Service-Wide Denial of AI Service

The entire self-hosted Open WebUI instance becomes unresponsive to all users and API callers until the request times out or the process is restarted; repeating the payload sustains the outage.

AML.T0029

Authenticated Chat Access

Attacker uses a standard, low-privileged Open WebUI account (or one obtained via credential compromise) to open a chat session with the target instance.

AML.T0012

Malicious Skill Mention Payload

Attacker sends a chat message containing an unclosed "<$" skill-mention tag crafted to trigger catastrophic backtracking in SKILL_MENTION_RE/strip_re.

AML.T0049

Event Loop Exhaustion

The regex engine's quadratic backtracking consumes CPU inside the shared asyncio event loop, blocking all other coroutines from making progress.

AML.T0029

Service-Wide Denial of AI Service

The entire self-hosted Open WebUI instance becomes unresponsive to all users and API callers until the request times out or the process is restarted; repeating the payload sustains the outage.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	>= 0.9.2, < 0.10.0	`0.10.0`
149.6K 4 dependents Pushed 3d ago 81% patched ~6d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

1) Patch to Open WebUI 0.10.0 immediately — this fixes both the SKILL_MENTION_RE and strip_re patterns in backend/open_webui/utils/middleware.py. 2) If immediate patching isn't possible, add a reverse-proxy/WAF rule to flag or reject chat payloads containing an unclosed "<$" sequence, and cap maximum chat message length. 3) Detection: monitor event-loop lag / response-latency metrics for spikes correlated with chat message submissions, and audit access logs for repeated "<$" patterns in message bodies. 4) As a structural mitigation (not a fix), run multiple worker processes/replicas behind a load balancer so one stalled event loop doesn't take down the entire service. 5) Restrict access to trusted/vetted accounts on instances where a single-user DoS is unacceptable.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Framework Plugin AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Clause 8.1 - Operational planning and control

NIST AI RMF

MEASURE 2.6 - AI system safety and security risks are evaluated

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-59220?

Open WebUI's skill-mention parser uses regular expressions with overlapping quantifiers that can be forced into catastrophic backtracking: an authenticated user simply sends a chat message containing an unclosed "<$" skill tag, and the single asyncio event loop that serves the entire self-hosted instance freezes for every user, session, and API call until the request times out or the process is restarted. This matters for AI platform operators because Open WebUI is a widely deployed self-hosted LLM front end, and the flaw needs nothing more than a standard authenticated account (PR:L, no admin rights, no victim interaction) to knock a whole deployment offline — a classic low-skill availability hit rather than a data-loss issue (CVSS 6.5, C:N/I:N/A:H). Exploitation likelihood is currently low: EPSS sits at 0.295% (79th percentile), there is no CISA KEV listing, no public PoC, and no Nuclei template, so this is not an active-exploitation emergency — but the trivial trigger (any logged-in user, one crafted message) makes it an easy DoS lever for a disgruntled insider or a compromised low-privilege account. Upgrade to Open WebUI 0.10.0, which fixes the SKILL_MENTION_RE and strip_re patterns in backend/open_webui/utils/middleware.py; until patched, filter or rate-limit chat payloads containing unclosed "<$" sequences and watch for event-loop latency spikes correlated with chat submissions.

Is CVE-2026-59220 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-59220, increasing the risk of exploitation.

How to fix CVE-2026-59220?

1) Patch to Open WebUI 0.10.0 immediately — this fixes both the SKILL_MENTION_RE and strip_re patterns in backend/open_webui/utils/middleware.py. 2) If immediate patching isn't possible, add a reverse-proxy/WAF rule to flag or reject chat payloads containing an unclosed "<$" sequence, and cap maximum chat message length. 3) Detection: monitor event-loop lag / response-latency metrics for spikes correlated with chat message submissions, and audit access logs for repeated "<$" patterns in message bodies. 4) As a structural mitigation (not a fix), run multiple worker processes/replicas behind a load balancer so one stalled event loop doesn't take down the entire service. 5) Restrict access to trusted/vetted accounts on instances where a single-user DoS is unacceptable.

What systems are affected by CVE-2026-59220?

This vulnerability affects the following AI/ML architecture patterns: Self-hosted LLM chat UI / front-end, Model serving / inference gateway, Multi-user AI platforms.

What is the CVSS score for CVE-2026-59220?

CVE-2026-59220 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.57%.

What is the AI security impact?

Affected AI Architectures

Self-hosted LLM chat UI / front-endModel serving / inference gatewayMulti-user AI platforms

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Clause 8.1

NIST AI RMF: MEASURE 2.6

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.2 before 0.10.0, the SKILL_MENTION_RE and strip_re regular expressions in backend/open_webui/utils/middleware.py parsed <$skillId|label> skill mentions with overlapping quantifiers, allowing an authenticated chat message containing <$ without a closing > to trigger quadratic backtracking and block the asyncio event loop. This issue is fixed in version 0.10.0.

Exploitation Scenario

An authenticated but low-privileged user of a shared Open WebUI instance — for example a standard employee account, or one compromised via credential stuffing since MFA isn't enforced by default in many deployments — opens a chat session and sends a message containing "<$" followed by a long run of non-matching characters with no closing ">". The middleware attempts to match this against SKILL_MENTION_RE, triggering quadratic/catastrophic backtracking that pegs CPU on the request-handling coroutine. Because this runs inside the shared asyncio event loop, every other coroutine — other users' chat completions, RAG queries, background API calls — stalls behind it, effectively taking the entire self-hosted AI platform offline until the request times out or an operator restarts the process. The attacker can repeat the payload across new sessions to sustain the outage indefinitely.

Weaknesses (CWE)

CWE-1333 Inefficient Regular Expression Complexity Primary CWE-1333 Inefficient Regular Expression Complexity

CWE-1333 — Inefficient Regular Expression Complexity: The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

[Architecture and Design] Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
[System Configuration] Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

Source: MITRE CWE corpus.