HIGHCVSS 7.5

GHSA-w466-2wfc-8g58

Open WebUI has vulnerable dependency on starlette via fastapi

Published: 2025-03-20
Modified: 2026-10-26
Sources: github-advisory

Summary

In version 0.3.32 of open-webui, the application uses a vulnerable version of the starlette package through its dependency on fastapi. The starlette package versions <=0.49 are susceptible to uncontrolled resource consumption, which can be exploited to cause a denial of service through memory exhaustion. This issue is addressed in fastapi version 0.115.3.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
PyPI	open-webui	—	0.5.8

Remediation: Upgrade to 0.5.8 or later.

References

https://github.com/advisories/GHSA-w466-2wfc-8g58

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.