CVE-2024-12868: Open WebUI has vulnerable dependency on starlette via fastapi
(updated )
In version 0.3.32 of open-webui, the application uses a vulnerable version of the starlette package through its dependency on fastapi. The starlette package versions <=0.49 are susceptible to uncontrolled resource consumption, which can be exploited to cause a denial of service through memory exhaustion. This issue is addressed in fastapi version 0.115.3.
References
- github.com/advisories/GHSA-w466-2wfc-8g58
- github.com/encode/starlette/security/advisories/GHSA-f96h-pmfr-66vw
- github.com/open-webui/open-webui/commit/941836406219f51dc5f807ea426795b42884b688
- github.com/open-webui/open-webui/releases/tag/v0.5.8
- huntr.com/bounties/56175583-70e3-4d53-94de-3f3a8e2423ec
- nvd.nist.gov/vuln/detail/CVE-2024-47874
Code Behaviors & Features
Detect and mitigate CVE-2024-12868 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →