{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "open-webui",
          "vendor": "open-webui",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.5.0, \u003c 0.11.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/open_webui/utils/misc.py advanced through a chat history by map key but tracked visited entries using each message body\u0027s optional id field. An authenticated user could store id-less messages in a parent cycle and trigger a non-terminating walk that blocked the async event loop, grew memory until termination, and remained persistent across process restarts. This issue is fixed in version 0.11.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T21:40:06.412Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-webui/open-webui/security/advisories/GHSA-jqhh-cjmq-vmv6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-jqhh-cjmq-vmv6"
        },
        {
          "name": "https://github.com/open-webui/open-webui/pull/28034",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-webui/open-webui/pull/28034"
        },
        {
          "name": "https://github.com/open-webui/open-webui/commit/5c79ccc9e5c9efc2bc024d8f0b9757652ece929a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-webui/open-webui/commit/5c79ccc9e5c9efc2bc024d8f0b9757652ece929a"
        },
        {
          "name": "https://github.com/open-webui/open-webui/releases/tag/v0.11.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"
        }
      ],
      "source": {
        "advisory": "GHSA-jqhh-cjmq-vmv6",
        "discovery": "UNKNOWN"
      },
      "title": "Open WebUI: Any authenticated user can hang the server via a cyclic chat message history"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-88002",
    "datePublished": "2026-09-09T21:40:06.412Z",
    "dateReserved": "2026-09-09T19:19:27.406Z",
    "dateUpdated": "2026-09-09T21:40:06.412Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.5.0"
            },
            {
              "fixed": "0.11.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-88002"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-09T23:53:59Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\nChat histories are stored as an unvalidated JSON object. The walk that reconstructs a chat\u0027s message chain detected repeats using each message\u0027s own `id` field while moving through the history by map key, so a message that simply omitted `id` was never recorded as visited. A history whose messages referenced each other in a parent cycle therefore made the walk run forever. Any account with the default `user` role could store such a chat and trigger the walk, blocking the server for everyone.\n\n## Preconditions\nOne account with the default `user` role. No administrator rights, no additional permissions, no configuration change and no non-default setting: creating a chat is available to every user out of the box. The attack runs entirely against the attacker\u0027s own chat, so no knowledge of any other user\u0027s data is needed. Instances where every account is trusted are affected in the sense that the fault is reachable, but require a user acting deliberately.\n\n## Impact\nThe walk is synchronous and runs on the asyncio event loop, so while it spins, every request from every user is blocked, including unauthenticated `/health` and administrator endpoints. External health checks and orchestrator liveness probes fail alongside the UI. The list it appends to grows without bound, so a memory-capped deployment ends in an out-of-memory kill rather than a hang. The work is not cancelled when the client disconnects, so one fire-and-forget request is enough and the attacker can disconnect immediately. The malformed chat stays in the database, so restarting the process does not clear the condition: the next request that walks that chat hangs the new process, and recovery requires deleting the stored chat. No data is disclosed, altered or deleted.\n\n## Fix\nFixed in 0.11.1 by https://github.com/open-webui/open-webui/commit/5c79ccc9e5c9efc2bc024d8f0b9757652ece929a. The walk now records the map key it is currently positioned at instead of the message\u0027s self-reported `id`, so it terminates after at most one step per stored message whatever the message contents are. Upgrading fully resolves the issue, including for chats stored while the deployment was on an affected version, which become harmless once the walk terminates.\n\n## Root cause\nAffected component: the message-chain reconstruction helper in `backend/open_webui/utils/misc.py`, reached from every path that rebuilds a chat\u0027s history, including chat completion, per-chat statistics, context compaction, subagents and timers. Affected setup: all builds from 0.5.0 up to and including 0.11.0.\n\nThe loop\u0027s visited set was keyed on the message body\u0027s `id` field while the loop itself advanced by looking the parent up as a key in the history map, so the two used different notions of identity. That `id` field is part of the stored chat object and is fully attacker-controlled, and the guard explicitly skipped recording it when absent, which left the exit condition unreachable for any message that omitted it. The write path does not validate the structure of a chat\u0027s history, so a history containing id-less messages in a parent cycle was persisted exactly as submitted.\n\n## Proof of concept\nAs a default-role user on a running instance, store one chat of two messages that reference each other as parents, with the `id` field omitted:\n\n```json\n{\"chat\":{\"title\":\"poc\",\"history\":{\"currentId\":\"A\",\"messages\":{\n  \"A\":{\"parentId\":\"B\",\"role\":\"user\",\"content\":\"a\",\"childrenIds\":[]},\n  \"B\":{\"parentId\":\"A\",\"role\":\"assistant\",\"content\":\"b\",\"childrenIds\":[]}}}}}\n```\n\n`POST /api/v1/chats/new` stores it verbatim. A single subsequent `GET /api/v1/chats/stats/usage` as the same user then never returns. Sampled during the hang, the worker consumed one full CPU core and reached 1.86 GB resident within 60 seconds, still growing. Unauthenticated `GET /health` and administrator API calls both time out for as long as the process lives, and continue to do so after the attacker\u0027s connection closes. Restarting the server restores service until the first request that walks the stored chat, which hangs the new process the same way.\n\nOn 0.11.1 the same payload returns promptly, `/health` stays available throughout, and a well-formed chat still resolves its full history.\n\n## Credits\n@YashvantHange, who reported the missing-`id` cycle in the message-chain walk, demonstrated the resulting server-wide outage end to end against a live instance, and showed that it survives both attacker disconnect and a process restart.",
  "id": "GHSA-jqhh-cjmq-vmv6",
  "modified": "2026-09-09T23:53:59Z",
  "published": "2026-09-09T23:53:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-jqhh-cjmq-vmv6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/pull/28034"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/commit/5c79ccc9e5c9efc2bc024d8f0b9757652ece929a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI: Any authenticated user can hang the server via a cyclic chat message history"
}