Skip to main content

Allocation of Resources Without Limits or Throttling

CVE-2024-7983

High
7.5/10

Summary

In the open-webui package versions v0.1.117 through v0.5.12 , an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a Denial of Service (DoS). The server becomes unresponsive to other requests until the conversion is complete.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-770 - Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

Advisory Timeline

  • Published