CVE-2024-7983: Openwebui Open Webui

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes unresponsive to other requests until the conversion is complete.

Affected products

• Openwebui Open Webui: version 0.3.8 only

Published 2025-03-20. Last modified 2026-06-17.