CVE-2024-12534: Open WebUI DoS Vulnerability

CVE-2024-12534 Overview

CVE-2024-12534 is a denial of service vulnerability affecting Open WebUI version 0.3.32. The application fails to enforce character length limits on the email and password fields during sign-in. Attackers can submit excessively large payloads to exhaust server CPU, memory, and disk resources. The endpoint requires no authentication, allowing unauthenticated remote attackers to render the service unavailable to legitimate users. The vulnerability is tracked under [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
Unauthenticated attackers can trigger resource exhaustion by submitting oversized strings to the login endpoint, causing service outage.

Affected Products

Open WebUI version 0.3.32
openwebui:open_webui component (Python package)
Deployments exposing the sign-in endpoint to untrusted networks

Discovery Timeline

2025-03-20 - CVE-2024-12534 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12534

Vulnerability Analysis

Open WebUI is a self-hosted web interface for large language models. Version 0.3.32 exposes a sign-in endpoint that accepts email and password fields without validating input length. When a client submits multi-megabyte or larger strings, the server allocates memory and CPU cycles to parse, process, and validate these values.

Repeated submission of oversized payloads compounds the resource impact. The server may exhaust memory, saturate CPU, or fill disk space through logging of the malicious inputs. Legitimate users cannot authenticate while the server is starved of resources.

Because the sign-in endpoint sits before authentication, the attack requires no credentials. Any network-reachable client can trigger the condition. Public-facing deployments are directly exposed.

Root Cause

The root cause is missing input validation on the email and password request parameters. The application accepts arbitrarily large string values without enforcing maximum length, request body size limits, or rate limiting on the sign-in path. This falls under [CWE-400: Uncontrolled Resource Consumption].

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends HTTP POST requests to the Open WebUI sign-in endpoint with oversized values in the email and/or password fields. Multiple concurrent connections or repeated payloads amplify the resource drain until the service becomes unresponsive.

The vulnerability affects availability only. Confidentiality and integrity are not impacted. Refer to the Huntr Bounty Listing for the original report.

Detection Methods for CVE-2024-12534

Indicators of Compromise

HTTP POST requests to Open WebUI sign-in endpoints containing email or password field values exceeding normal size (typically >1 KB)
Sudden spikes in server memory, CPU, or disk utilization tied to the Open WebUI process
Elevated request rates to the /auth or sign-in route from a single source or small set of sources
Web server or reverse proxy logs showing abnormally large request bodies preceding service degradation

Detection Strategies

Inspect reverse proxy and application logs for POST requests with content-length values that exceed reasonable authentication payload sizes.
Correlate resource utilization alerts on the Open WebUI host with authentication endpoint traffic patterns.
Deploy web application firewall (WAF) rules that flag or block oversized request bodies targeting the sign-in path.

Monitoring Recommendations

Monitor CPU, memory, and disk metrics on Open WebUI hosts with alerting thresholds tied to baseline usage.
Track sign-in endpoint request rates and payload sizes for anomaly identification.
Capture and retain application logs for post-incident analysis of oversized submission patterns.

How to Mitigate CVE-2024-12534

Immediate Actions Required

Upgrade Open WebUI to a version later than 0.3.32 that enforces input length validation on authentication fields.
Enforce request body size limits at the reverse proxy or ingress layer in front of Open WebUI.
Apply rate limiting to the sign-in endpoint to reduce the effectiveness of repeated oversized submissions.
Restrict network exposure of Open WebUI to trusted networks or place it behind an authenticated gateway where feasible.

Patch Information

The vulnerability is reported against Open WebUI 0.3.32 through the Huntr Bounty Listing. Administrators should track the Open WebUI project repository for a fixed release that adds length validation on the email and password sign-in fields, and update to the fixed version.

Workarounds

Configure the reverse proxy (for example, Nginx client_max_body_size or an equivalent directive) to reject requests larger than a small threshold on the sign-in path.
Deploy a WAF rule that drops POST requests to the sign-in endpoint when field lengths exceed expected values.
Apply per-IP rate limiting on the authentication endpoint to slow repeated abuse.
Place Open WebUI behind a VPN or identity-aware proxy so unauthenticated network access is not possible.

bash

# Nginx configuration example limiting body size and rate on the sign-in path
http {
    limit_req_zone $binary_remote_addr zone=signin:10m rate=5r/m;

    server {
        location /api/v1/auths/signin {
            client_max_body_size 4k;
            limit_req zone=signin burst=5 nodelay;
            proxy_pass http://open_webui_upstream;
        }
    }
}