CVE-2026-59220: Open WebUI ReDoS Denial of Service via Malformed Skill Mentions

Technical summary

The vulnerability exists in backend/open_webui/utils/middleware.py where SKILL_MENTION_RE and strip_re regular expressions contain overlapping quantifiers used to parse skill mention syntax (<$skillId|label>). When a malformed skill mention string—specifically one starting with <$ but lacking a closing >—is processed, the regex engine experiences catastrophic backtracking. This quadratic-time behavior blocks the asyncio event loop, causing denial of service. The flaw is a classic ReDoS (Regular Expression Denial of Service) condition stemming from ambiguous regex construction. Authentication is required to send chat messages, limiting exposure to logged-in users.

Business impact

An authenticated attacker can disable Open WebUI instances by sending specially crafted chat messages, rendering the platform unavailable to all users until the service is restarted. For organizations relying on Open WebUI for internal AI workflows, this creates a targeted disruption vector. The impact is availability-focused; there is no data breach or privilege escalation risk. Recovery requires service restart, which may disrupt ongoing work sessions and AI-powered integrations dependent on the platform.

Affected systems

Open WebUI versions 0.9.2 through 0.9.x (all versions before 0.10.0) are vulnerable. The vulnerability is present in the core message-processing middleware, affecting all Open WebUI deployments running these versions regardless of deployment model (containerized, standalone, cloud-hosted). Version 0.10.0 and later include a fix and are not affected.

Exploitability

Exploitation requires a valid authenticated user account on the target Open WebUI instance. The attacker sends a single crafted chat message and observes service degradation or unavailability. No complex setup, social engineering, or multi-step attack chain is necessary. The low barrier to exploitation within authenticated contexts is partially offset by the requirement for user credentials. In environments with high user counts or federation features, the risk is elevated. The vulnerability is trivial to trigger once authenticated access is obtained.

Remediation

Upgrade to Open WebUI version 0.10.0 or later, which contains a corrected regular expression implementation that eliminates the overlapping quantifier patterns. For deployments unable to upgrade immediately, restrict access to the platform to trusted users and monitor event loop performance metrics for signs of ReDoS exploitation. Additionally, implement rate limiting on chat message submission to mitigate the impact of repeated malicious messages. Network-level measures (e.g., WAF rules) cannot fully prevent this since the vulnerability is in backend logic, not HTTP parsing.

Patch guidance

1. Verify your current Open WebUI version via the admin dashboard or by checking the container image tag/release notes. 2. Back up your Open WebUI configuration, user database, and any persistent chat histories before upgrading. 3. Pull and deploy version 0.10.0 or the latest available release from the official Open WebUI repository. 4. Restart the service and confirm availability through a test chat message. 5. Review deployment logs for any errors or performance anomalies post-upgrade. 6. If upgrading from significantly older versions (e.g., 0.8.x), consult the official changelog for breaking changes or migration steps.

Detection guidance

Monitor Open WebUI service logs and metrics for patterns consistent with ReDoS: - Spikes in CPU or event loop latency coinciding with chat message submissions - Slow or unresponsive API responses, particularly to /api/chat endpoints - Chat messages containing incomplete skill mention syntax (<$ without closing >) - Repeated malformed messages from the same user account or within a short time window Implement alerting on event loop blocking duration (if exposed via instrumentation) and correlate with unusual message patterns. Query audit logs for malformed skill mention payloads if your deployment captures message content.

Why prioritize this

Although the CVSS score is moderate (6.5 MEDIUM), the vulnerability carries elevated operational risk due to its denial-of-service nature and trivial exploitability within authenticated contexts. Open WebUI deployments serving critical AI workflows or supporting large user bases should prioritize upgrading to 0.10.0. The vulnerability does not appear on the KEV catalog, indicating it has not yet been widely exploited in the wild, providing a window for remediation before broad adoption of exploit techniques.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a medium-severity availability impact (CWE-1333: Inefficient Regular Expression Complexity) with a low barrier to exploitation for authenticated users. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates network accessibility, low attack complexity, and required privilege (authentication) offset by high availability impact and no confidentiality or integrity loss. In environments where Open WebUI is business-critical or exposed to a large or untrusted user base, risk may exceed the baseline score; conversely, isolated internal deployments with a small trusted user count may tolerate delay in patching.

Frequently asked questions