CVE-2026-88000 Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/id/messages/messageid used the chat-history deletion helper in backend/openwebui/models/chats.py to follow childrenIds without recording visited message identifiers...

CVE-2026-88000 Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/id/messages/messageid used the chat-history deletion helper in backend/openwebui/models/chats.py to follow childrenIds without recording visited message identifiers...

CVE-2026-87013

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/id/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used by DELETE /api/v1/folders/id and POST...

CVE-2026-87013 Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/id/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used by DELETE /api/v1/folders/id and POST...

CVE-2026-87013

Open WebUI versions 0.10.0 through 0.11.1 contain a denial-of-service vulnerability in the folder tree functionality. The POST /api/v1/folders/{id}/update/parent endpoint allowed an authenticated user to place a folder under itself or one of its descendants, creating a parent cycle . Because the ...

GHSA-7W5X-HRQM-74C2 smol-toml: Denial of Service via malformed TOML documents

Summary parse can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline i.e. the comment "ends" the document. The library fails to exit an internal loop when attempting to find the end of the structure, resetting its...

EUVD-2026-71261

smol-toml: Denial of Service via malformed TOML documents...

smol-toml: Denial of Service via malformed TOML documents

Summary parse can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline i.e. the comment "ends" the document. The library fails to exit an internal loop when attempting to find the end of the structure, resetting its...

OPENSUSE-SU-2026:21818-1 Security update for libcupsfilters

This update for libcupsfilters fixes the following issues: - CVE-2026-64611: infinite-loop CPU-exhaustion DoS in cfIEEE1284NormalizeMakeModel on empty MDL field bsc1273145. - CVE-2026-64612: malformed PNG aborts CUPS image filter process bsc1273146...

CVE-2026-6554

A flaw was found in libpcap. The Berkeley Packet Filter BPF interpreter incorrectly handles offsets in 'ja L' instructions, allowing backward jumps without limiting loop iterations. A local attacker could provide a specially crafted filter program, leading to an infinite loop and causing a Denial...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

SUSE CVE-2026-6554

libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. A crafted filter program or the 'protochain' primitive used on a crafted network packet can cause the interpret...

Linux Wireless Scan Function CVE

The vulnerability of the cfg80211mergeprofile function in the net/wireless/scan.c module related to Linux’s wireless communication support is associated with the execution of a loop with an unreachable exit condition an “infinite loop”. Exploiting this vulnerability could allow an attacker to...

CVE-2026-88000: Loop with Unreachable Exit Condition

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/chats/id/messages/messageid used the chat-history deletion helper in backend/openwebui/models/chats.py to follow childrenIds without recording visited message identifiers...

PT-2026-89177

Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...

Linux netem_enqueue Heap Buffer Overflow DoS

The vulnerability of the netemenqueue function in the net/sched/schnetem.c module of the Linux operating system’s network scheduling subsystem is related to the execution of a loop with an unreachable exit condition an “infinite loop”. Exploiting this vulnerability could allow a remote attacker t...

Linux L2TP Buffer Overflow

The vulnerability of the l2tpsessionunhash function in the net/l2tp/l2tpcore.c module of the Linux operating system’s L2TP tunneling protocol implementation is related to the execution of a loop with an unreachable exit condition “Infinite loop”. Exploiting this vulnerability could allow an...

PyPDF Heap Buffer Overflow DoS

The vulnerability of the TreeObject.insertchild function in the Python library for working with PDF files PyPDF is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux IPv6 net/ipv6/route.c Heap Buffer Overflow DoS

The vulnerability of the rt6fillnode function in the net/ipv6/route.c module of the IPv6 protocol implementation in the Linux operating system is related to the execution of a loop with an unreachable exit condition an “infinite loop”. Exploitation of this vulnerability could allow a remote...

RoundCube Loop DoS

The vulnerability of the RoundCube Webmail email client is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service failures...