Open-WebUI Resource Exhaustion Vulnerability Allowing Denial-of-Service Conditions

A denial-of-service vulnerability has been identified in Open-WebUI version 0.3.32. The issue arises during the sign-in process, where the application fails to validate the character length of email and password inputs. This lack of validation allows users to submit excessively large payloads, which can exhaust server resources such as CPU, memory, and disk space. As a result, the service becomes unavailable to legitimate users, creating a resource exhaustion attack vector that does not require authentication.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the application to become unresponsive and unavailable for legitimate users.