Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3, published 20 March 2025.

Which products and versions are affected?

open-webui (npm) SEMVER:introduced=0,last_affected=0.3.21; open-webui (PyPI) ECOSYSTEM:introduced=0,last_affected=0.3.21.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run open-webui (npm) or open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Open WebUI unauthenticated multipart boundary denial of service

Severity: low · CVSS 3 · Published 2025-03-20

Open WebUI is a web interface for interacting with AI models like Ollama. An unauthenticated attacker can exploit a flaw in how the application parses file upload requests to exhaust server CPU and memory resources, rendering the service unavailable to legitimate users. The vulnerability requires no authentication or user interaction and can be triggered remotely.

Technologies: open-webui (npm), open-webui (PyPI). Vendors: npm, PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3, published 20 March 2025.
Which products and versions are affected?: open-webui (npm) SEMVER:introduced=0,last_affected=0.3.21; open-webui (PyPI) ECOSYSTEM:introduced=0,last_affected=0.3.21.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run open-webui (npm) or open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Open WebUI's handling of multipart/form-data boundaries, inherited from an upstream flaw in the python-multipart library (CVE-2024-53981). The application processes malformed multipart boundaries byte-by-byte, with each byte triggering resource allocation and logging events. An attacker can craft requests with deformed boundaries (e.g., appending extra characters or CR/LF bytes) to affected endpoints such as /ollama/models/upload, /audio/api/v1/transcriptions, and /rag/api/v1/doc. This forces the server to iterate excessively over boundary data, consuming CPU and memory while blocking legitimate request processing. The attack requires no authentication or user interaction and is remotely exploitable over the network. Patched versions of python-multipart (≥0.0.18) and corresponding Open WebUI updates address the root cause.

Affected products

Open WebUI open-webui 0 through 0.3.21

Timeline

2025-03-20: disclosed: Vulnerability published on GitHub Advisory Database
2025-03-20: advisory: GHSA-5ccf-884p-4jjq advisory issued; related upstream CVE-2024-53981 in python-multipart published November 2024

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.