Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server… (CVE-2026-109295)

The Open WebUI software versions 0.11.0 through before 0.11.4 have a ReDoS vulnerability (CVE-2026-109295) where authenticated users can cause denial of service by invoking grep_knowledge_files or grep_chat_files functions with regex patterns that trigger catastrophic backtracking. This stalls server workers and blocks the event loop, degrading service availability. The CVSS v3.1 score is 6.5 (high severity) with network attack vector, low attack complexity, requiring privileges and no user interaction, impacting availability only.

The vulnerability allows authenticated users to stall server workers by exploiting regex processing, causing denial of service conditions that block the event loop for about two seconds per repeated call. There is no impact on confidentiality or integrity, but availability is significantly affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict authenticated user input for file search patterns or implement rate limiting to mitigate repeated exploitation attempts.