CVE-2026-109295

Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grep knowledge files or grep chat files with a catastrophically backtracking regex, blocking the event loop for two seconds per repeated call.