Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

Summary The built-in knowledge search tools let a chat participant choose the pattern used to grep knowledge files. Patterns containing regex metacharacters were compiled with Python's backtracking re engine and run against every line of every reachable file, with no time limit anywhere on that...

python-pillow: Regular expression DoS in PDF format parser

A flaw was found in python-pillow. The PDF parser has a catastrophic backtracking regex that could be used as a DOS attack...