Listen to this Post
The built-in knowledge search tools in Open WebUI allow a chat participant to supply a custom pattern used to grep knowledge files. When the pattern contains regex metacharacters, the application compiles it using Python’s backtracking `re` engine and runs it against every line of every reachable file without any time limit. A single crafted pattern such as `(x|x)y` combined with a matching input line (e.g., 30 `x` characters and no y) triggers catastrophic backtracking, pinning one CPU core for as long as the attacker desires.
Because the search executes synchronously inside the event loop, the affected worker becomes unresponsive to all other requests during the attack. In single‑worker deployments (the default UVICORN_WORKERS=1), this takes down the entire instance; in multi‑worker setups, each malicious request consumes one worker. The cost scales exponentially with the length of the matching text—a 24‑character subject takes 1.2 seconds, 28 characters take 19 seconds, 30 characters take 74 seconds, and a 40‑character subject extrapolates to roughly a day of CPU time. The same search against a literal pattern completes in under a microsecond.
The root cause lies in `backend/open_webui/tools/knowledge_fs.py` where `build_matcher` compiles the caller’s pattern and returns an unbounded match function. The default‑configuration caller, `grep_knowledge_files` in backend/open_webui/tools/builtin.py, runs that matcher over every line of every reachable file. `build_matcher` treats any pattern containing regex metacharacters as a regex, so no explicit flag is needed to reach the vulnerable compiler. The only limits in place are on results (matches returned) and files scanned—neither bounds the time a single line can consume. Since backtracking cost is exponential in the length of the matched text rather than in the pattern, capping pattern length or line length would not have prevented the issue. The engine had no timeout available and none was imposed elsewhere.
Preconditions are minimal: the knowledge builtin tool group is enabled by default, `ENABLE_KB_EXEC` defaults to False, and `USER_PERMISSIONS_CHAT_FILE_UPLOAD` defaults to true, allowing any authenticated user to upload a file and read it back. The only non‑deterministic step is convincing the model to call the tool with the attacker’s literal pattern—reliable in practice by instructing the model in the chat, but not guaranteed on every turn.
The vulnerability was fixed in version 0.11.0 via pull request 27471. The fix replaces Python’s `re` with the `regex` engine, which supports a per‑search timeout, and imposes a global 2‑second matching budget per tool call. After the budget expires, the tool returns an error instead of continuing to match. Upgrading is sufficient; no additional configuration is required.
DailyCVE Form:
Platform: Open WebUI
Version: 0.9.6 to <0.11.0
Vulnerability: ReDoS via grep_knowledge_files
Severity: Moderate
Date: 2026-08-02
Prediction: Patch expected 2026-08-02 (0.11.0)
What Undercode Say:
Analytics show that exploitation requires only a single authenticated user with file upload privileges. The attack is reliable in practice because modern LLMs readily follow instructions to call the tool with a provided pattern. The exponential cost means that even short payloads (30 characters) can consume a worker for over a minute, and 40 characters extrapolate to a full day of CPU time. In production environments with default single‑worker settings, this translates to a complete denial of service for all users. Multi‑worker deployments lose one worker per request, allowing an attacker to gradually exhaust the entire pool.
Bash commands and codes related to the vulnerability:
Check if your Open WebUI instance is vulnerable Version check open-webui --version Test payload (conceptual - do not run against production) Upload a file with 30 'x' characters and no 'y' echo "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" > payload.txt In a chat, instruct the model to call: grep_knowledge_files(pattern="(x|x)y", file_id="<uploaded_file_id>")
Exploit:
An attacker with any authenticated account can:
- Upload a text file containing a single line of 30 `x` characters (no
y). - In a chat with a model that has knowledge tools available, instruct the model to call `grep_knowledge_files` with the pattern `(x|x)y` and the uploaded file’s ID.
- The request never returns; the worker’s CPU stays at 100%, and concurrent requests from other users on the same worker do not complete.
The vulnerability is triggered because the pattern `(x|x)y` causes catastrophic backtracking when run against a line of `x` characters without ay. The regex engine tries all possible ways to group the `x`s before failing to find ay, leading to exponential time growth.
Protection:
- Immediate: Upgrade to Open WebUI version 0.11.0 or later.
- If upgrade is not possible: Consider disabling the knowledge builtin tool group or restricting file upload permissions (though this may impact functionality). Note that capping pattern length or line length does not mitigate the issue because backtracking cost is exponential in the matched text length, not the pattern length.
- Long‑term: The fix introduces a 2‑second matching budget per tool call using the `regex` engine with timeout support. No additional configuration is needed after upgrading.
Impact:
- Availability: Complete denial of service for the affected worker. In single‑worker deployments (default), the entire instance becomes unresponsive.
- Scalability: Cost scales exponentially with the length of the matching text. A 40‑character subject extrapolates to roughly a day of CPU time.
- No Confidentiality or Integrity: The attack does not read or alter any data.
- Affected Users: Every other user of the affected worker experiences stalled or failed requests. An attacker can repeat the attack to exhaust multiple workers in multi‑worker deployments.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
