CVE-2026-88002: CVE-2026-88002: Infinite Loop Denial of Service in Open WebUI Chat History Reconstruction

#security #cve #cybersecurity

CVE-2026-88002: Infinite Loop Denial of Service in Open WebUI Chat History Reconstruction

Vulnerability ID: CVE-2026-88002
CVSS Score: 6.5
Published: 2026-09-09

An infinite loop vulnerability (CWE-835) in Open WebUI versions 0.5.0 through 0.11.0 allows authenticated attackers to cause a complete and persistent Denial of Service (DoS) of the backend. By submitting a specially crafted chat history containing cyclic message references that omit internal message identifiers, the cycle detection mechanism is bypassed. This triggers an infinite synchronous traversal that blocks the single-threaded asyncio event loop and exhausts system memory, causing the application to crash.

TL;DR

Authenticated users can trigger a persistent infinite loop in the Open WebUI backend, completely freezing the server and exhausting host memory by saving a cyclic chat history.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-835
Attack Vector: Network (AV:N)
Privileges Required: Low (PR:L)
User Interaction: None (UI:N)
Availability Impact: High (A:H)
Exploit Status: Proof of Concept
CISA KEV Status: Not Listed

Affected Systems

Open WebUI
open-webui: >= 0.5.0, < 0.11.1 (Fixed in: 0.11.1)

Code Analysis

Commit: 5c79ccc

Fix infinite loop in get_message_list cycle detection

Mitigation Strategies

Upgrade to version 0.11.1 or higher
Manually hotpatch backend/open_webui/utils/misc.py
Audit database for cyclic chat message references

Remediation Steps:

Stop the running Open WebUI service
Pull the updated Docker image for version 0.11.1
Run database queries to identify and purge any malformed chat history rows
Start the service with the patched software version

References

Read the full report for CVE-2026-88002 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community