CVE-2026-70493

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.6 through 0.10.x

Description The built-in knowledge search tools allow a chat participant to specify a pattern used to grep knowledge files. When patterns contain regex metacharacters, they are compiled using Python's backtracking re engine and executed against every line of reachable files without a time limit. A specially crafted pattern, such as (x|x)*y, combined with a matching uploaded file line, can cause a Regular Expression Denial of Service (ReDoS). This occurs because the search runs synchronously inside the event loop, pinning a CPU core and blocking the worker from serving other users. The computational cost increases exponentially with the length of the matching text.

Technical details include:

Recommendations Update Open WebUI to version 0.11.0.