---
id: "CVE-2026-109295"
page: "https://infrastack.ai/live/CVE-2026-109295"
kind: "vulnerability"
aliases: ["CVE-2026-109295", "GHSA-gfjp-5hc9-852r"]
title: "Any authenticated user can repeatedly stall a worker via file-search regex on the event loop"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "open-webui", "fixed": ["0.11.4"], "affected": ">= 0.11.0, < 0.11.4", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ai-tooling", "cwe-1333", "open-webui", "python", "self-hosted"]
not_affected_if: ["managed-hosting", "version-0.11.4-or-later"]
published_at: "2026-09-27T19:30:44+00:00"
first_seen_at: "2026-11-09T22:53:27+00:00"
updated_at: "2026-11-09T23:10:12+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-gfjp-5hc9-852r", "first_seen_at": "2026-11-09T22:53:27+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109295", "first_seen_at": "2026-11-09T23:10:12+00:00"}]
exploit_sources: []
---

# Any authenticated user can repeatedly stall a worker via file-search regex on the event loop

Link for people: https://infrastack.ai/live/CVE-2026-109295 (this .md is for agents)

Any logged-in user can submit a crafted regex through Open WebUI's built-in file search tools, which runs on the server's event loop and freezes the worker for about 2 seconds per call. Repeated calls can stall the worker again and again, denying service to other users.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:open-webui affected >= 0.11.0, < 0.11.4 fixed 0.11.4

## How to check

- Check the installed version with `pip show open-webui` and treat `0.11.0` through `0.11.3` as affected.
- Confirm `UVICORN_WORKERS` and whether `ENABLE_KB_EXEC` is still at its default of `False`.

## Fix

- `open-webui` `0.11.4`

## Timeline

- 2026-11-09T22:53:27+00:00 ghsa-repo https://github.com/open-webui/open-webui/security/advisories/GHSA-gfjp-5hc9-852r
- 2026-11-09T23:10:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109295

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/open-webui/open-webui/security/advisories/GHSA-gfjp-5hc9-852r
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/open-webui-0.11.0-before-0.11.4-redos-via-grep-knowledge-files-event-loop

## From the sources

# Any authenticated user can repeatedly stall a worker via file-search regex on the event loop

## Summary
The built-in file search tools let a chat participant choose the pattern used to grep files. Since 0.11.0 each search has been capped at 2 seconds of matching time, but the matching itself still ran directly on the server's event loop. A crafted pattern that backtracks until the cap is hit therefore froze the whole worker for about 2 seconds on every call, and nothing stopped the calls from being repeated.

## Preconditions
- Default configuration. The knowledge builtin tool group is enabled by default, and with `ENABLE_KB_EXEC` at its default of `False` the model is offered `grep_knowledge_files`, which accepts a file id.
- Any authenticated user, no elevated role and no workspace permission.
- One file the attacker can read. `USER_PERMISSIONS_CHAT_FILE_UPLOAD` defaults to true and a user can always read their own upload.
- A model willing to call the tool with the attacker's literal pattern. This is reliable in practice by instructing the model in your own chat, but not guaranteed on a given turn.
- The chat file tool `grep_chat_files` is affected the same way, but it is only offered when a model's File Context capability has been turned off.
- Deployments running with `UVICORN_WORKERS` at its default of 1 stall the whole instance; multi-worker deployments stall one worker per call.

## Impact
Availability, against every other user of the affected worker. Each call held the event loop for the full 2 second budget, during which the worker handled no other request, and every further call from the same or another chat held it again. The same file searched with a literal pattern finished in a few milliseconds. There is no confidentiality or integrity effect, and no data is read or altered.

## Fix
Fixed in 0.11.4. https://github.com/open-webui/open-webui/pull/29621 moved the built-in chat and knowledge file searches off the event loop into a worker thread, the knowledge filesystem search was moved off the event loop the same way, and pattern matching switched to the RE2 engine, which runs in linear time and cannot backtrack catastrophically. Upgrading is sufficient; there is nothing an operator has to configure.

## Root cause
- `backend/open_webui/tools/builtin.py`, `grep_knowledge_files` and `grep_chat_files`: called the synchronous file search directly from the async tool.
- `backend/open_webui/tools/knowledge_fs.py`, `build_matcher`: compiled the caller's pattern with a backtracking engine under a 2 second timeout.
- Affected builds: 0.11.0 through 0.11.3. Earlier versions had no time limit at all and are covered by GHSA-2f54-p244-32q6.

The fix for GHSA-2f54-p244-32q6 bounded how long one search could run, but a time limit on a synchronous call does not give the event loop back while the call is running. The search still executed on the loop thread, so for the whole budget the worker could not serve anyone else, and the budget reset on every tool call.

## Proof of concept
Against the tool code of 0.11.3 as an ordinary user:

1. Upload a text file whose content is a single line of 28 `a` characters followed by `!`.
2. In a chat, instruct the model to call `grep_knowledge_files` with the pattern `(a|a)+$` and that file's id.
3. The tool returns `Search exceeded 2s, narrow the pattern` after about 2 seconds. A task scheduled every 50 ms on the same event loop does not run for 2.06 seconds while the search is in progress. Repeating the call repeats the stall.

Measured by running the real tool functions of each release with a concurrent 50 ms event-loop heartbeat (file lookup seeded directly with the file above):

| version | tool | call time | longest heartbeat gap |
| ------- | ---- | --------- | --------------------- |
| 0.11.3 | grep_knowledge_files | 2.007s | 2.057s |
| 0.11.3 | grep_chat_files | 2.009s | 2.059s |
| 0.11.4 | grep_knowledge_files | 0.004s | 0.051s |
| 0.11.4 | grep_chat_files | 0.005s | 0.051s |

## Credits
@yousif-IQ, for the finding.
@tahahassan773, analysis.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_