AI Threat Alert
An unauthenticated attacker can crash open-webui entirely by sending a file upload request with an oversized multipart boundary string—no credentials or AI knowledge required. Any team running open-webui for self-hosted LLM access (Ollama, OpenAI-compatible backends) must patch to 0.4.7 immediately. Until patched, block or rate-limit file upload endpoints at the WAF or reverse proxy layer.
What is the risk?
CVSS 7.5 HIGH with network-accessible, zero-authentication, zero-user-interaction exploitation. The attack is trivially simple—crafting a malformed multipart HTTP request requires no AI/ML expertise. Open-webui is widely deployed in enterprise and research environments as the primary interface to self-hosted LLMs, meaning a successful attack takes down all model interactions for every user on the instance. Not in CISA KEV, but the low exploitation bar and high deployment prevalence elevate operational risk significantly above what the CVSS score alone suggests.
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Open WebUI | pip | < 0.4.7 | 0.4.7 |
Do you use Open WebUI? You're affected.
How severe is it?
What is the attack surface?
What should I do?
5 steps-
Patch immediately: upgrade open-webui to >= 0.4.7, which pins python-multipart to a patched version (fixes GHSA-59g5-xgcq-4qw3 / CVE-2024-53981).
-
If patching is not immediately possible: block or rate-limit file upload endpoints (/api/v1/files or equivalent) at WAF/reverse proxy; reject multipart/form-data requests with boundary strings exceeding 70 characters (RFC 2046 limit).
-
Audit your full Python AI stack for python-multipart < 0.0.18—FastAPI, Starlette, and other frameworks share this dependency.
-
Detection: monitor for CPU saturation spikes or HTTP 5xx error bursts correlated with multipart POST requests to file upload endpoints.
-
In cloud deployments, set resource quotas (CPU limits) on the open-webui container to bound the DoS blast radius.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is GHSA-6wj5-5pgr-jwq8?
An unauthenticated attacker can crash open-webui entirely by sending a file upload request with an oversized multipart boundary string—no credentials or AI knowledge required. Any team running open-webui for self-hosted LLM access (Ollama, OpenAI-compatible backends) must patch to 0.4.7 immediately. Until patched, block or rate-limit file upload endpoints at the WAF or reverse proxy layer.
Is GHSA-6wj5-5pgr-jwq8 actively exploited?
No confirmed active exploitation of GHSA-6wj5-5pgr-jwq8 has been reported, but organizations should still patch proactively.
How to fix GHSA-6wj5-5pgr-jwq8?
1. Patch immediately: upgrade open-webui to >= 0.4.7, which pins python-multipart to a patched version (fixes GHSA-59g5-xgcq-4qw3 / CVE-2024-53981). 2. If patching is not immediately possible: block or rate-limit file upload endpoints (/api/v1/files or equivalent) at WAF/reverse proxy; reject multipart/form-data requests with boundary strings exceeding 70 characters (RFC 2046 limit). 3. Audit your full Python AI stack for python-multipart < 0.0.18—FastAPI, Starlette, and other frameworks share this dependency. 4. Detection: monitor for CPU saturation spikes or HTTP 5xx error bursts correlated with multipart POST requests to file upload endpoints. 5. In cloud deployments, set resource quotas (CPU limits) on the open-webui container to bound the DoS blast radius.
What systems are affected by GHSA-6wj5-5pgr-jwq8?
This vulnerability affects the following AI/ML architecture patterns: ML UI/Chat interfaces, self-hosted LLM deployments, model serving.
What is the CVSS score for GHSA-6wj5-5pgr-jwq8?
GHSA-6wj5-5pgr-jwq8 has a CVSS v3.1 base score of 7.5 (HIGH).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0029 Denial of AI Service AML.T0034 Cost Harvesting AML.T0049 Exploit Public-Facing Application Compliance Controls Affected
What are the technical details?
Original Advisory
A vulnerability in open-webui/open-webui version 79778fa allows an attacker to cause a Denial of Service (DoS) by uploading a file with a malformed multipart boundary. By appending a large number of characters to the end of the multipart boundary, the server continuously processes each character, rendering the application inaccessible. This issue can prevent all users from accessing the application until the server recovers.
Exploitation Scenario
An adversary targeting an organization's internal AI platform identifies an exposed open-webui instance—common in dev and research environments, frequently deployed without authentication. They craft a multipart/form-data POST to the file upload endpoint with a boundary value padded with thousands of characters (e.g., `Content-Type: multipart/form-data; boundary=--------AAAA...x10000`). The server's python-multipart parser iterates character-by-character through the oversized boundary, pegging CPU at 100%. Looped in a simple script, the attacker maintains persistent DoS with minimal bandwidth, blocking the entire team from accessing their LLM tooling indefinitely. No CVE exploitation skill, authentication, or AI expertise required—this is a trivial HTTP request crafting exercise.
Weaknesses (CWE)
CWE-400 — Uncontrolled Resource Consumption: The product does not properly control the allocation and maintenance of a limited resource.
- [Architecture and Design] Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
- [Architecture and Design] Mitigation of resource exhaustion attacks requires that the target system either: The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker. recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H References
Timeline
Related Vulnerabilities
CVE-2026-44551 9.1 open-webui: LDAP auth bypass — full account takeover
Same package: open-webui CVE-2026-45672 8.8 open-webui: code exec gate bypass via API endpoint
Same package: open-webui CVE-2025-64495 8.7 Open WebUI: XSS-to-RCE via malicious prompt injection
Same package: open-webui CVE-2026-44552 8.7 open-webui: Redis cache poisoning enables cross-instance tool hijack
Same package: open-webui CVE-2026-45315 8.7 open-webui: stored XSS → JWT theft and admin takeover
Same package: open-webui