Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands… (CVE-2026-109298)

Open WebUI versions prior to 0.11.4 compile user-chosen grep patterns for knowledge and chat file search tools using a regex engine vulnerable to unbounded expansion of nested counted repetitions at compile time. This allows authenticated users to invoke the model's grep_knowledge_files function with crafted nested repetition patterns that block the event loop and exhaust worker memory resources, resulting in a denial of service condition. The CVSS 3.1 base score is 6.5, reflecting a high severity denial of service vulnerability with network attack vector, low attack complexity, and requiring privileges (authenticated user).

The vulnerability allows authenticated users to cause denial of service by blocking the event loop and exhausting worker memory through crafted nested repetition regex patterns. There is no impact on confidentiality or integrity reported. The primary impact is service availability disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict authenticated user input for grep patterns or implement input validation to prevent nested counted repetition patterns that can cause unbounded regex expansion.