CVE-2024-12534

Summary

CVE-2024-12534 is a vulnerability affecting version v0.3.32 of open-webui/open-webui. It allows users to submit oversized payloads in the email and password fields during sign-in, due to insufficient character length validation. This issue results in a Denial of Service (DoS) condition, as the server becomes overwhelmed when processing excessively large strings, leading to exhaustion of CPU, memory, and disk space. The service becomes unavailable for legitimate users, making the server susceptible to resource exhaustion attacks without requiring authentication.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.