All vulnerabilities
GHSA-w466-2wfc-8g58

open-webui: Open WebUI has vulnerable dependency on starlette via fastapi

open-webuipipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in0.5.8Fixed versionGitHub
Published20 Mar 2025Updated 26 Oct 2026GitHub

What fixes it

  • 0.5.8open-webui, pipGitHub
  • 0.5.8open-webui, PyPIOSVpip install "open-webui>=0.5.8"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In version 0.3.32 of open-webui, the application uses a vulnerable version of the starlette package through its dependency on fastapi. The starlette package versions <=0.49 are susceptible to uncontrolled resource consumption, which can be exploited to cause a denial of service through memory exhaustion. This issue is addressed in fastapi version 0.115.3.

Text from GitHub Advisory Database

Affected versions 52

  • open-webui, pip< 0.5.8GitHub
  • open-webui, PyPIfrom first release, fixed in 0.5.8OSV
  • open-webui, PyPI0.1.124OSV
  • open-webui, PyPI0.1.125OSV
  • open-webui, PyPI0.2.0OSV
  • open-webui, PyPI0.2.1OSV
  • open-webui, PyPI0.2.2OSV
  • open-webui, PyPI0.2.3OSV
  • open-webui, PyPI0.2.4OSV
  • open-webui, PyPI0.2.5OSV
  • open-webui, PyPI0.3.0OSV
  • open-webui, PyPI0.3.1OSV
  • open-webui, PyPI0.3.10OSV
  • open-webui, PyPI0.3.12OSV
  • open-webui, PyPI0.3.13OSV
  • open-webui, PyPI0.3.14OSV
  • open-webui, PyPI0.3.15OSV
  • open-webui, PyPI0.3.16OSV
  • open-webui, PyPI0.3.17OSV
  • open-webui, PyPI0.3.17.dev2OSV
  • open-webui, PyPI0.3.17.dev3OSV
  • open-webui, PyPI0.3.17.dev4OSV
  • open-webui, PyPI0.3.17.dev5OSV
  • open-webui, PyPI0.3.18OSV
  • open-webui, PyPI0.3.19OSV
  • open-webui, PyPI0.3.2OSV
  • open-webui, PyPI0.3.20OSV
  • open-webui, PyPI0.3.21OSV
  • open-webui, PyPI0.3.22OSV
  • open-webui, PyPI0.3.23OSV
  • open-webui, PyPI0.3.24OSV
  • open-webui, PyPI0.3.25OSV
  • open-webui, PyPI0.3.26OSV
  • open-webui, PyPI0.3.27OSV
  • open-webui, PyPI0.3.27.dev1OSV
  • open-webui, PyPI0.3.27.dev2OSV
  • open-webui, PyPI0.3.27.dev3OSV
  • open-webui, PyPI0.3.28OSV
  • open-webui, PyPI0.3.29OSV
  • open-webui, PyPI0.3.3OSV
  • open-webui, PyPI0.3.30OSV
  • open-webui, PyPI0.3.30.dev1OSV
  • open-webui, PyPI0.3.30.dev2OSV
  • open-webui, PyPI0.3.31OSV
  • open-webui, PyPI0.3.31.dev1OSV
  • open-webui, PyPI0.3.32OSV
  • open-webui, PyPI0.3.33OSV
  • open-webui, PyPI0.3.33.dev1OSV
  • open-webui, PyPI0.3.34OSV
  • open-webui, PyPI0.3.35OSV
  • open-webui, PyPI0.3.4OSV
  • open-webui, PyPI0.3.5OSV

References 6