DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-70493: CVE-2026-70493: Regular Expression Denial of Service (ReDoS) in Open WebUI Knowledge Search

#security #cve #cybersecurity

CVE-2026-70493: Regular Expression Denial of Service (ReDoS) in Open WebUI Knowledge Search

Vulnerability ID: CVE-2026-70493
CVSS Score: 6.5
Published: 2026-08-04

CVE-2026-70493 is a critical Regular Expression Denial of Service (ReDoS) vulnerability affecting Open WebUI from version 0.9.6 up to (but excluding) 0.11.0. An authenticated user can submit a custom, highly complex regular expression pattern to search files within the knowledge base. Because these expressions are compiled and executed synchronously using Python's standard backtracking re module inside an asynchronous event loop, the server becomes unresponsive. A single request is capable of stalling the entire platform, denying access to all concurrent users of the system.

TL;DR

Authenticated users can submit complex regular expressions to search knowledge base files, triggering thread-blocking exponential backtracking that completely stalls the single-threaded Uvicorn worker of Open WebUI, causing a complete denial of service.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-1333 (Inefficient Regular Expression Complexity)
  • Attack Vector: Network
  • CVSS v3.1 Score: 6.5 (Medium)
  • EPSS Score: Not Available
  • Impact: Denial of Service (DoS) via thread blocking
  • Exploit Status: Proof-of-Concept Verified
  • CISA KEV Status: Not Listed

Affected Systems

  • Open WebUI backend application server running on Python ASGI/Uvicorn environments
  • open-webui: >= 0.9.6, < 0.11.0 (Fixed in: 0.11.0)

Code Analysis

Commit: 3ab2026

Fix ReDoS in knowledge search by introducing the third-party regex library with dynamic context-aware match timeout budgets.

Exploit Details

Mitigation Strategies

  • Upgrade Open WebUI to version 0.11.0 or newer to replace standard Python re with the timeout-enabled regex engine.
  • Deploy Open WebUI with multiple Uvicorn workers by setting UVICORN_WORKERS environment variable to at least 2 or 4.
  • Implement a reverse proxy or Web Application Firewall (WAF) to block or sanitize complex regex inputs within API chat routes.
  • Limit concurrent request rates for authenticated endpoints to prevent parallel request amplification attacks.

Remediation Steps:

  1. Stop the running Open WebUI container or server process.
  2. Update your installation configuration, Dockerfile, or docker-compose file to fetch open-webui version >= 0.11.0.
  3. Set the environment variable UVICORN_WORKERS=4 to ensure high availability across multi-threaded operations.
  4. Restart the Open WebUI container and verify that the requirements.txt utilizes regex==2026.5.9.
  5. Perform a validation check using a standard test pattern to confirm timeouts trigger correctly when execution times are exceeded.

References

Read the full report for CVE-2026-70493 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)