CVE-2024-7983

Published: Mar 20, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security@huntr.dev (Secondary)

Description

In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes unresponsive to other requests until the conversion is complete.

Affected (1)

Products: Openwebui: Open Webui

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openwebui Open Webui	Version 0.3.8

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (1)

https://huntr.com/bounties/f8156ca5-1328-480f-a72b-8d3dfdad87dc

Source: security@huntr.dev

ExploitThird Party Advisory

Timeline

No history available yet.