Executive brief
Open WebUI is a web interface for interacting with AI models like Ollama. An unauthenticated attacker can exploit a flaw in how the application parses file upload requests to exhaust server CPU and memory resources, rendering the service unavailable to legitimate users. The vulnerability requires no authentication or user interaction and can be triggered remotely.
Technical details
The vulnerability exists in Open WebUI's handling of multipart/form-data boundaries, inherited from an upstream flaw in the python-multipart library (CVE-2024-53981). The application processes malformed multipart boundaries byte-by-byte, with each byte triggering resource allocation and logging events. An attacker can craft requests with deformed boundaries (e.g., appending extra characters or CR/LF bytes) to affected endpoints such as /ollama/models/upload, /audio/api/v1/transcriptions, and /rag/api/v1/doc. This forces the server to iterate excessively over boundary data, consuming CPU and memory while blocking legitimate request processing. The attack requires no authentication or user interaction and is remotely exploitable over the network. Patched versions of python-multipart (≥0.0.18) and corresponding Open WebUI updates address the root cause.
Affected products
- Open WebUI open-webui 0 through 0.3.21
Timeline
- 2025-03-20: disclosed: Vulnerability published on GitHub Advisory Database
- 2025-03-20: advisory: GHSA-5ccf-884p-4jjq advisory issued; related upstream CVE-2024-53981 in python-multipart published November 2024