CVE-2026-70493: Open WebUI vulnerable to regular expression denial of service

# CVE-2026-70493: Open WebUI vulnerable to regular expression denial of service

https://gcdradar.vercel.app/incidents/cve-2026-70493-open-webui-vulnerable-to-regular-expression-d · AIR-2026-0049 · closed 2026-08-04

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-08-04
- AI role: Attack on AI
- Products: Open WebUI
- CVE ids: CVE-2026-70493
- CVSS: 6.5

## Summary

From version 0.9.6 until 0.11.0, Open WebUI allowed chat participants to supply regex patterns that could cause excessive CPU consumption and block the event loop. This flaw was resolved in version 0.11.0.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-08-04: CVE-2026-70493: Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically (https://github.com/advisories/GHSA-2f54-p244-32q6)
- 2026-08-04: CVE-2026-70493: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. (https://nvd.nist.gov/vuln/detail/CVE-2026-70493)

## Sources

- 2026-08-04 NVD: CVE-2026-70493: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. https://nvd.nist.gov/vuln/detail/CVE-2026-70493
- 2026-08-04 GitHub Advisory Database: CVE-2026-70493: Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically https://github.com/advisories/GHSA-2f54-p244-32q6

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.