{"id":"GHSA-w466-2wfc-8g58","title":"Open WebUI has vulnerable dependency on starlette via fastapi","summary":"Open WebUI has vulnerable dependency on starlette via fastapi","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"open-webui","product":"open-webui","ecosystem":"pip","affected":["open-webui < 0.5.8"],"patched":["open-webui 0.5.8"],"published":"2025-03-20","updated":"2026-10-26","sourceUpdated":"2026-10-26T15:30:05.509056834Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-w466-2wfc-8g58","references":[{"url":"https://github.com/encode/starlette/security/advisories/GHSA-f96h-pmfr-66vw"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47874"},{"url":"https://github.com/open-webui/open-webui/commit/941836406219f51dc5f807ea426795b42884b688"},{"url":"https://github.com/open-webui/open-webui"},{"url":"https://github.com/open-webui/open-webui/releases/tag/v0.5.8"},{"url":"https://huntr.com/bounties/56175583-70e3-4d53-94de-3f3a8e2423ec"},{"url":"https://github.com/advisories/GHSA-w466-2wfc-8g58"}],"tags":["osv","pip","ghsa"],"cwe":["CWE-400"],"ingestedAt":"2026-10-26T15:29:30.491Z","slug":"GHSA-w466-2wfc-8g58","body":"## Overview\n\nIn version 0.3.32 of open-webui, the application uses a vulnerable version of the starlette package through its dependency on fastapi. The starlette package versions <=0.49 are susceptible to uncontrolled resource consumption, which can be exploited to cause a denial of service through memory exhaustion. This issue is addressed in fastapi version 0.115.3.\n\n## Affected packages\n\n- `open-webui < 0.5.8`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `open-webui 0.5.8`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}