CVE-2026-109295Medium· 6.5▾ SunlitOpen WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grep_knowledge_…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grep_knowledge_files or grep_chat_files with a catastrophically backtracking regex, blocking the event loop for two seconds per repeated call.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2021-3807High· 7.5ansi-regex is vulnerable to Inefficient Regular Expression Complexity
CVE-2024-21538High· 7.5Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization
CVE-2024-21490High· 7.5This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0
CVE-2026-66766High· 7.5SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability
CVE-2025-61581High· 7.5** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control. This issue affects Apache Traffic Control: all versions. People with access to the management interface of the Traffic R…
CVE-2026-104628Medium· 6.5Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnerability