Medium severity6.5NVD Advisory· Published Oct 12, 2026
CVE-2026-109298
CVE-2026-109298
Description
Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grep_knowledge_files with short nested-repetition patterns, blocking the event loop and exhausting worker memory.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <0.11.4
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.