Open WebUI versions 0.11.0 through 0.11.3 compile user‑chosen grep patterns for knowledge and chat file search with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. When an authenticated user supplies a short nested‑repetition pattern, the engine blocks the event loop and exhausts worker memory, leading to a denial of service for the application. This flaw is categorized as a CWE‑400 Uncontrolled Resource Consumption and CWE‑770 Unbounded Repetition Vulnerability.

The vulnerable product is open-webui’s open‑webui, impacting all releases from version 0.11.0 up to and including 0.11.3. The fix is available in release 0.11.4 and later.

With a CVSS score of 7.1 the vulnerability represents moderate severity, and it is not listed in CISA’s KEV catalog. The EPSS score is 0.00393 (below 1%), indicating a very low exploitation probability, but the lack of known active exploitation does not diminish the risk: any authenticated user can trigger the regex compilation that blocks the server and drains memory. The attack requires legitimate credentials but does not rely on additional privileges or public network exposure. The result is a service disruption that can affect all users of the instance until the patch is applied.