CVE-2026-109297
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Oct 12, 2026
CISA due date
—
The record
Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rules (or, in 0.11.0, lowercase frequencies or omitted RRULE prefixes) that expand per-second synchronously, blocking the shared event loop for minutes per request and on every scheduler poll.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63341 Aedes is an MQTT broker that can run on any stream server. CWE-400
- CVE-2026-62300 Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP… CWE-400
- CVE-2026-62254 LibreDWG is a free C library to read and write DWG files. CWE-400
- CVE-2026-62250 LibreDWG is a free C library to read and write DWG files. CWE-400
- CVE-2026-62303 Pistache is a high-performance REST toolkit written in C++. CWE-400
- CVE-2026-62160 Daptin is a GraphQL/JSON-API headless CMS. CWE-400
- CVE-2026-61848 Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3… CWE-400
- CVE-2026-61854 VoiceSentinel is a real-time voice moderation system for Minecraft servers. CWE-400