HIGH 7.5 PyPI
Open WebUI has vulnerable dependency on starlette via fastapi
GHSA-w466-2wfc-8g58
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
In version 0.3.32 of open-webui, the application uses a vulnerable version of the starlette package through its dependency on fastapi. The starlette package versions <=0.49 are susceptible to uncontrolled resource consumption, which can be exploited to cause a denial of service through memory exhaustion. This issue is addressed in fastapi version 0.115.3.
References
- WEB https://github.com/encode/starlette/security/advisories/GHSA-f96h-pmfr-66vw
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-47874
- WEB https://github.com/open-webui/open-webui/commit/941836406219f51dc5f807ea426795b42884b688
- PACKAGE https://github.com/open-webui/open-webui
- WEB https://github.com/open-webui/open-webui/releases/tag/v0.5.8
- WEB https://huntr.com/bounties/56175583-70e3-4d53-94de-3f3a8e2423ec
Ready to move
Start Securing
Free, no credit card | First findings in minutes