CVE-2026-109298

🗓️ 12 Oct 2026 16:04:56Reported by MendType

Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can hav...

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2026-109298	12 Oct 202617:07	–	circl
CVE	CVE-2026-109298	12 Oct 202616:04	–	cve
Cvelist	CVE-2026-109298 Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex	12 Oct 202616:04	–	cvelist
EUVD	EUVD-2026-97600	12 Oct 202616:04	–	euvd
NVD	CVE-2026-109298	12 Oct 202617:17	–	nvd
Positive Technologies	PT-2026-110715	12 Oct 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-109298 Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex	12 Oct 202616:04	–	vulnrichment

Source	Link
vulncheck	www.vulncheck.com/advisories/open-webui-0.11.0-before-0.11.4-memory-exhaustion-via-knowledge-search-regex
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109298.json
github	www.github.com/open-webui/open-webui/security/advisories/GHSA-gww9-mhgj-pfqh
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-109298
github	www.github.com/open-webui/open-webui/commit/97e013a66169c4fcd7f26ab9e41a4ff260ffd4da

13 Oct 2026 12:46Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.5

CVSS 47.1

EPSS0.00393

CWE-400