CVE-2026-109294 open-webui CVE debrief

Who should care

Defenders responsible for Open WebUI deployments, particularly those using versions 0.6.42 before 0.11.4, should assess their exposure and prioritize updating to version 0.11.4 or later. System administrators and security teams should verify the version of Open WebUI in use and monitor server performance for signs of potential exploitation.

Why it matters

CVE-2026-109294 is a high-severity vulnerability in Open WebUI that allows authenticated users to cause a denial of service by exhausting server memory. Defenders should prioritize verifying and updating Open WebUI to version 0.11.4 or later.

• Denial of service for all users due to server memory exhaustion
• Potential for authenticated users to cause significant resource consumption
• Need for verification of Open WebUI version and potential exposure
• Importance of updating to version 0.11.4 or later to mitigate the vulnerability

Technical summary

The Open WebUI application, versions 0.6.42 before 0.11.4, is vulnerable to an uncontrolled resource consumption issue due to the get_image_base64_from_url function decompressing remote images without bounds checking. Authenticated users can supply compressed remote image URLs in chat messages, leading to server memory exhaustion and a denial of service for all users. Defenders should prioritize verifying and updating Open WebUI to version 0.11.4 or later to mitigate this vulnerability. Systems using affected versions should be checked for potential exposure, and server memory usage should be monitored to prevent similar issues.

Defensive priority

Defenders should prioritize verifying and updating Open WebUI to version 0.11.4 or later to mitigate this vulnerability. Systems using affected versions should be checked for potential exposure.

Recommended defensive actions

• Verify Open WebUI version and update to 0.11.4 or later if necessary
• Check systems using affected Open WebUI versions for potential exposure
• Monitor server memory usage and adjust configurations to prevent similar issues
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and source item provide details on the vulnerability, including its impact on Open WebUI versions 0.6.42 before 0.11.4. However, there is limited information on potential exploits or affected systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.