CVE-2026-109298 open-webui CVE debrief

Who should care

Defenders responsible for Open WebUI deployments should assess exposure and prioritize patching or mitigation to prevent potential memory exhaustion attacks. This includes reviewing system memory usage and event loop performance, restricting access to the knowledge search feature to trusted users, and monitoring for potential exploitation attempts. Security teams and vulnerability management teams should also be aware of this vulnerability and take steps

Why it matters

CVE-2026-109298 is a high-severity vulnerability in Open WebUI that allows authenticated users to cause memory exhaustion via knowledge search regex. Defenders should prioritize patching or mitigating this vulnerability to prevent potential memory exhaustion attacks.

• Potential memory exhaustion leading to event loop blocking
• Possible worker memory exhaustion
• Need for patching or mitigation to prevent attacks
• Verification of system memory usage and event loop performance required

Technical summary

The vulnerability is caused by the compilation of user-chosen grep patterns with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can exploit this by calling grep_knowledge_files with short nested-repetition patterns, potentially blocking the event loop and exhausting worker memory. The affected product is Open WebUI, and the vulnerability has a CVSS score of 7.1, indicating high severity. Defenders should prioritize patching or mitigating this vulnerability to prevent potential memory exhaustion attacks.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability to prevent potential memory exhaustion attacks.

Recommended defensive actions

• Patch Open WebUI to version 0.11.4 or later
• Restrict access to the knowledge search feature to trusted users
• Monitor system memory usage and event loop performance
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories and patch commits. The vulnerability has a CVSS score of 7.1 and is considered high-severity. The source item and CVE record do not provide additional information on the exploitation of this vulnerability in the wild or any known mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.