CVE-2024-7036: Open Webui Denial of Service Vulnerability

CVE-2024-7036 Overview

CVE-2024-7036 is a denial of service vulnerability in open-webui/open-webui version 0.3.8. An unauthenticated attacker can register a new account using an excessively large string in the name field. Rendering this oversized value causes the Admin panel to become unresponsive. Administrators lose the ability to delete, edit, or add users through the affected interface. Authenticated users holding low-privilege accounts can trigger the same condition by updating their own profile name. The flaw is tracked under CWE-400: Uncontrolled Resource Consumption and was disclosed through the Huntr Bounty Listing.

Critical Impact
Unauthenticated attackers can render the Open WebUI Admin panel unusable, blocking all user management operations until the malicious account data is removed from the backend.

Affected Products

Open WebUI version 0.3.8 (cpe:2.3:a:openwebui:open_webui:0.3.8)
Self-hosted deployments exposing the signup endpoint to untrusted networks
Multi-tenant instances permitting low-privilege users to modify profile fields

Discovery Timeline

2025-03-20 - CVE-2024-7036 published to NVD
2025-07-18 - Last updated in NVD database

Technical Details for CVE-2024-7036

Vulnerability Analysis

The vulnerability resides in the user registration and profile update flows of Open WebUI 0.3.8. The application accepts arbitrarily large strings in the name field without enforcing a maximum length. When the Admin panel queries the user list, it attempts to render every record including the oversized name value. The resulting payload causes the front-end to hang or crash, blocking administrative workflows.

The attack does not require authentication because the public signup endpoint is reachable by any network client. Authenticated low-privilege users can reach the same outcome through the profile update API. The Exploit Prediction Scoring System (EPSS) places this issue at 0.744%, reflecting limited observed exploitation activity, but the operational impact on a single tenant is immediate.

Root Cause

The root cause is missing input validation on the name attribute of user objects. Open WebUI does not constrain the length or character composition of the field at the API boundary, the persistence layer, or the rendering layer. Without an upper bound, a single malicious record consumes excessive memory and CPU during list rendering, satisfying the conditions for CWE-400.

Attack Vector

An attacker submits an HTTP POST request to the signup endpoint with a name field containing megabytes of arbitrary text. The server accepts the payload and persists it. When an administrator next loads the Admin panel, the browser fetches the malformed record and stalls while attempting to parse and render it. The Admin panel remains unresponsive for the duration that the malicious record exists in storage. See the Huntr Bounty Listing for additional reproduction details.

Detection Methods for CVE-2024-7036

Indicators of Compromise

User records in the Open WebUI database containing name values larger than several kilobytes
Signup requests to /api/v1/auths/signup with anomalously large request bodies
Admin panel sessions that fail to load the user management view or time out repeatedly
New accounts created from unfamiliar IP addresses immediately preceding Admin panel failures

Detection Strategies

Inspect web server access logs for POST requests to signup and profile endpoints with Content-Length values exceeding expected thresholds
Query the user store for records whose name field length exceeds a sane administrative limit such as 256 characters
Monitor reverse proxy or WAF telemetry for outbound responses serving abnormally large user-list JSON payloads

Monitoring Recommendations

Configure web application firewall rules to alert on request bodies above a defined size threshold for authentication and profile routes
Track Admin panel availability and front-end error rates as a service health metric
Forward Open WebUI application and proxy logs to a centralized analytics platform to correlate signup spikes with administrative outages

How to Mitigate CVE-2024-7036

Immediate Actions Required

Identify and delete user records containing oversized name values directly from the backend database
Restrict access to the Open WebUI signup endpoint using network controls or by disabling open registration
Audit recently created accounts and revoke any that were registered from unexpected sources
Upgrade Open WebUI to a release later than 0.3.8 that enforces input length validation

Patch Information

At the time of NVD publication, no vendor advisory URL was associated with this CVE. Operators should track the Open WebUI project releases and apply any version newer than 0.3.8 that addresses input validation on user profile fields. The Huntr Bounty Listing is the authoritative public reference for this issue.

Workarounds

Place Open WebUI behind a reverse proxy that enforces a strict maximum request body size on signup and profile endpoints
Disable public signup and provision accounts manually until a patched release is deployed
Apply a database constraint or trigger that rejects name values exceeding a defined length
Limit low-privilege users from modifying display name fields where business requirements allow

bash

# Example NGINX reverse proxy mitigation: cap request body size
# for Open WebUI authentication and profile endpoints
http {
    client_max_body_size 16k;

    server {
        listen 443 ssl;
        server_name openwebui.example.com;

        location /api/v1/auths/signup {
            client_max_body_size 4k;
            proxy_pass http://open_webui_backend;
        }

        location /api/v1/users/ {
            client_max_body_size 8k;
            proxy_pass http://open_webui_backend;
        }
    }
}