Open WebUI's automation recurrence parsing in versions 0.9.0 through 0.11.0 contains a resource consumption flaw that enumerates a continuous series of occurrences for minutely and hourly rules anchored to the year 2000. This long‑lived loop occupies the event loop, causing the scheduler to stall and blocking responsive access to HTTP and WebSocket endpoints for all users. The flaw is an instance‑wide denial of service, reflected by CWE‑1333 (DoS) and CWE‑400 (Uncontrolled Resource Consumption).

Affected users run open‑webui from 0.9.0 up to, but not including, 0.11.0. The issue is resolved in version 0.11.0 and later.

The CVSS score is 6.5, indicating moderate severity. No EPSS score is currently available, and the vulnerability is not listed in CISA KEV. An attacker can trigger the stall by submitting a recurrence rule that causes the parser to enumerate a high‑frequency schedule—this can be accomplished remotely via the standard user interface or API if the user has permission to create or modify automations. The attack vector is inferred to be remote, via the web interface or API, as the vulnerability is triggered by user‑submitted recurrence rules. Because the denial of service affects all users on the instance, the risk is significant whenever the vulnerability is present and the feature is enabled.