Live › vulnerability › GHSA-w466-2wfc-8g58
Go to dashboardOpen WebUI pulls in a vulnerable version of the starlette package through its fastapi dependency. An attacker can send requests that consume unbounded memory and crash the service (denial of service).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 15:12 UTC. All times on this page are UTC.
Any deployment of Open WebUI older than 0.5.8 that resolves a vulnerable starlette through fastapi is exposed. The exposure depends on the service being reachable by requests, so internet-facing or shared-network instances are the ones to check first. Instances already on 0.5.8 or later with a current fastapi can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| open-webui | pypi | < 0.5.8 | 0.5.8 |
pip show open-webui, and treat anything below 0.5.8 as affected.pip show starlette; versions <=0.49 are susceptible.pip show fastapi; versions below 0.115.3 pull in the vulnerable starlette.0.5.8 or later.0.115.3 or later so that starlette is no longer vulnerable.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In version 0.3.32 of open-webui, the application uses a vulnerable version of the starlette package through its dependency on fastapi. The starlette package versions <=0.49 are susceptible to uncontrolled resource consumption, which can be exploited to cause a denial of service through memory exhaustion. This issue is addressed in fastapi version 0.115.3.
This page as .md · .json · in your agent: get_signal("GHSA-w466-2wfc-8g58")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.