The vulnerability allows an authenticated user in Open WebUI to store messages without an id inside a cyclic parent chain. When the backend reconstructs the chat history by following map keys, it walks the cycle indefinitely, blocking the asynchronous event loop, consuming memory continuously, and ultimately terminating the process. This results in a denial‑of service on the API and UI. The weakness is a coding error that enables an infinite loop when a user supplies crafted inputs, corresponding to CWE‑835.

The vulnerability affects the Open WebUI platform from version 0.5.0 up to and including 0.10.x; a fix was introduced in version 0.11.1. Any deployment running a vulnerable version, regardless of host operating system or infrastructure, is susceptible.

The CVSS score of 6.5 indicates a moderate severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session and the ability to create or modify messages. The attacker can simply send id‑less messages in a cycle and trigger the event‑loop stall, which persists across restarts. Because the attack vector is limited to authenticated users, the risk is moderate but can effectively render a self‑hosted instance unusable.