Open WebUI has vulnerable dependency on starlette via fastapi
Date: 2025-03
Affected: pip/open-webui
Attack vector: dos
Category: vulnerability-disclosure
Severity: High
CWE: CWE-400
CVSS: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

In version 0.3.32 of open-webui, the application uses a vulnerable version of the starlette package through its dependency on fastapi. The starlette package versions <=0.49 are susceptible to uncontrolled resource consumption, which can be exploited to cause a denial of service through memory exhaustion. This issue is addressed in fastapi version 0.115.3.


Mitigations:

Architectural layers (MAESTRO):