CVE-2026-109298

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.11.0 through 0.11.3

Description The software uses a regex engine for its knowledge and chat file search tools that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can trigger the grep knowledge files() function using short nested-repetition patterns, which leads to the blocking of the event loop and exhaustion of worker memory.

Recommendations Update Open WebUI to version 0.11.4 or later.