In version v0.3.32 of open-webui/open-webui, the application allows users to submit large payloads in the email and password fields during the sign-in process due to the lack of character length validation on these inputs. This vulnerability can lead to a Denial of Service (DoS) condition when a user submits excessively large strings, exhausting server resources such as CPU, memory, and disk space, and rendering the service unavailable for legitimate users. This makes the server susceptible to resource exhaustion attacks without requiring authentication.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/c7c0a4e6-acd3-49b4-8684-2c2c27014b76 | Exploit Third Party Advisory |
Configurations
History
18 Jul 2025, 19:59
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:openwebui:open_webui:0.3.32:*:*:*:*:*:*:* | |
| References | () https://huntr.com/bounties/c7c0a4e6-acd3-49b4-8684-2c2c27014b76 - Exploit, Third Party Advisory | |
| First Time |
Openwebui
Openwebui open Webui |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-18 19:59
NVD link : CVE-2024-12534
Mitre link : CVE-2024-12534
JSON object : View
Products Affected
openwebui
- open_webui
CWE
CWE-400
Uncontrolled Resource Consumption